title: Keycloak-core: dos via account lockout
description: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
problem types: Overly Restrictive Account Lockout Mechanism
affected:
{
product: keycloak-core
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Build of Keycloak
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keycloak-core
defaultStatus: affected
cpes: cpe:/a:redhat:build_keycloak:22
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keycloak-core
defaultStatus: affected
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
}
metrics:
other: [
content: {'value': 'Low', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: Red Hat Product Security is not aware of a way to completely mitigate this issue. However, the following techniques can be used to help prevent exploitation:
- Put limits on frequency of account registration, restricting how often an attacker could utilize this attack
- Restrict new account registration to not allow email addresses in the username field, for example, by not allowing the "@" symbol. Note: this cannot prevent attacks against existing users who have registered with an email address.
If this vulnerability has been triggered, an administrator has two options to remedy it manually by modifying the second account (of the attacker):
- Delete the account
- Change the username