CVE-2020-1744 MEDIUM

CVE-2020-1744

Vendor Red Hat

Product keycloak

Weakness CWE-755

Published March 24, 2020

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

5.6/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

Key dates

02Disclosure timeline

March 24, 2020 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-1744 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/755.html

Related vulnerabilities

04Related CVE

CVE-2021-43173 Hanging RRDP request CVE-2019-0051 SRX5000 Series: Denial of Service vulnerability in SSL-Proxy feature. CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed CVE-2020-1632 Junos OS and Junos OS Evolved: Invalid BGP UPDATE sent to peer device may cause BGP session to terminate. CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions