CVE-2024-7318: Keycloak OTP Authentication Bypass Flaw

CVE-2024-7318 Overview

CVE-2024-7318 is a vulnerability in Red Hat Build of Keycloak affecting FreeOTP one-time password (OTP) validation. When the OTP token period is configured to the default 30 seconds, expired OTP codes remain valid for an additional 30 seconds. This effectively doubles the token lifetime to one minute and permits two valid OTPs to exist simultaneously.

The issue is tracked under CWE-324: Use of a Key Past its Expiration Date. It expands the attack window available to adversaries attempting to reuse intercepted or phished OTP codes and increases the risk of account compromise in multi-factor authentication (MFA) flows.

Critical Impact
Expired FreeOTP tokens remain valid for an extra 30 seconds, doubling the effective OTP lifetime and enabling reuse of previously issued codes against Keycloak-protected accounts.

Affected Products

Red Hat Build of Keycloak
Red Hat Single Sign-On deployments relying on FreeOTP with a 30-second token period
Keycloak instances configured with default OTP policy settings

Discovery Timeline

2024-09-09 - CVE-2024-7318 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7318

Vulnerability Analysis

Keycloak's OTP validation logic accepts FreeOTP codes beyond their intended expiration window. The OTP policy defines a token period, typically 30 seconds, that governs how long a generated code should be considered valid. The flawed validator accepts the previous period's token in addition to the current one, resulting in two concurrently valid codes.

The vulnerability lowers the effective entropy of the OTP challenge and provides adversaries additional time to reuse a stolen or intercepted code. Exploitation is network-based, requires no privileges, and requires no user interaction. However, the attacker must first obtain a valid OTP through phishing, session observation, or a compromised device.

The impact is limited to confidentiality and integrity of authentication decisions. Availability is not affected. Successful abuse depends on the attacker also possessing the primary credential, so the flaw functions as an MFA weakening issue rather than a standalone authentication bypass.

Root Cause

The root cause is an off-by-one in the OTP acceptance window. The validator continues to treat the previous 30-second interval's token as valid, contrary to the configured policy. This behavior is inconsistent with RFC 6238 guidance, which requires strict enforcement of the token period unless a documented skew tolerance is applied.

Attack Vector

An attacker who obtains a FreeOTP code, through phishing, shoulder surfing, or malware on the user's device, can submit that code up to 60 seconds after it was generated. If the attacker also holds the user's password, the extended window makes credential replay significantly more practical against Keycloak-protected applications.

No verified proof-of-concept code has been published for CVE-2024-7318. See the Red Hat CVE Analysis and Red Hat Bug Report #2301876 for authoritative technical details.

Detection Methods for CVE-2024-7318

Indicators of Compromise

Successful authentication events where the submitted OTP timestamp is more than 30 seconds older than the server acceptance time.
Repeated OTP submissions from different source IP addresses for the same user within a 60-second window.
Authentication events immediately following user reports of suspicious MFA prompts or phishing attempts.

Detection Strategies

Enable verbose audit logging in Keycloak and capture OTP validation events, including token issuance and acceptance timestamps.
Correlate Keycloak login events with endpoint telemetry to identify credential theft precursors such as info-stealer execution or credential-prompt phishing pages.
Baseline normal OTP submission latency per user and alert on submissions that occur at the edge of the extended acceptance window.

Monitoring Recommendations

Forward Keycloak KC_LOG and event listener output to a centralized SIEM for continuous review of authentication anomalies.
Monitor for concurrent sessions established from geographically improbable locations within short time intervals following OTP validation.
Track patch state of all Keycloak and Red Hat Single Sign-On deployments and alert on hosts running unpatched versions.

How to Mitigate CVE-2024-7318

Immediate Actions Required

Apply the fixes delivered in Red Hat Security Advisory RHSA-2024:6502 and RHSA-2024:6503 to all affected Keycloak deployments.
Inventory all identity providers using FreeOTP with a 30-second period and prioritize patching for internet-facing instances.
Rotate OTP secrets for accounts that showed anomalous authentication behavior prior to remediation.

Patch Information

Red Hat published fixes in advisories RHSA-2024:6502 and RHSA-2024:6503. Administrators running upstream Keycloak should apply the corresponding project release that enforces strict period boundaries in the OTP validator. Refer to the Red Hat CVE Analysis for the complete list of impacted product streams.

Workarounds

Increase the OTP token period in the Keycloak admin console so that the acceptance window is explicitly configured rather than relying on default behavior.
Reduce the OTP look-ahead and look-behind window settings under the Authentication OTP Policy to zero where operationally acceptable.
Require an additional authentication factor such as WebAuthn for high-value accounts until patching is complete.

bash

# Configuration example: tighten Keycloak OTP policy via kcadm
kcadm.sh update realms/<realm-name> \
  -s 'otpPolicyLookAheadWindow=0' \
  -s 'otpPolicyPeriod=30' \
  -s 'otpPolicyDigits=6' \
  -s 'otpPolicyAlgorithm=HmacSHA1'