CVE-2026-118030
4.2 MEDIUMPublished 2026-10-29 · Updated 2026-10-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-362
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100227
- MEDIUMCVE-2026-100394PoC
- MEDIUMCVE-2026-100546PoC
- HIGHCVE-2026-100805
- UNSCOREDCVE-2026-101041PoC
- HIGHCVE-2026-101309
- HIGHCVE-2026-101310
- HIGHCVE-2026-101311
Related by shared AI tags and CWE weakness class. Browse the full archive.