Security Resilience

CVE-2024-1722

Redhat Keycloak 23.0.5

Published
29 February 2024
Modified
17 June 2026
CVSS Score v3.1 3.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0077 55th percentile
Risk Priority 34 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-1722 is a low-severity Overly Restrictive Account Lockout Mechanism (CWE-645) vulnerability in Redhat Keycloak. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.

CWE(s)
CWE-645NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-4918Same product: Redhat Keycloak
CVE-2025-8419Same product: Redhat Keycloak
CVE-2025-5416Same product: Redhat Keycloak
CVE-2025-7365Same product: Redhat Keycloak
CVE-2023-6841Same product: Redhat Keycloak
CVE-2023-6927Same product: Redhat Keycloak
CVE-2024-7260Same product: Redhat Keycloak
CVE-2025-12150Same product: Redhat Keycloak
CVE-2026-3047Same product: Redhat Keycloak
CVE-2024-0560Same product: Redhat Keycloak

Affected Assets

redhat
keycloak
23.0.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-7 Unsuccessful Logon Attempts good match

Properly tuned thresholds and lock durations in the unsuccessful logon control stop an overly sensitive lockout from being introduced or exploited for DoS.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-03 partial match
blocks

Monitoring can detect resulting lockouts but does not prevent an overly restrictive mechanism.

PR.AA-01 partial match
blocks

Credential management policies directly govern lockout thresholds and reset procedures.

PR.AA-03 partial match
blocks

Authentication policies include lockout parameters that must not be overly restrictive.

PR.AA-05 partial match
blocks

Authorization policy definition and review encompass account lockout rules and exceptions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
degrades

Access control policy should define lockout thresholds and recovery procedures to avoid overly restrictive denial-of-service.

A.5.17 Authentication information partial match
degrades

Authentication information management includes setting lockout parameters that balance security against accidental lockouts.

A.5.18 Access rights partial match
degrades

Access rights administration must include procedures for unlocking accounts and reviewing lockout events.

A.7.11 Supporting utilities partial match
removes
A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes

References