Bug 2562005 (CVE-2026-118030)

Summary: CVE-2026-118030 keycloak-services: keycloak-services: HOTP race condition allows single OTP code reuse across concurrent logins
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-27 14:18:33 UTC 
A race condition vulnerability was found in Keycloak within the HOTP HMAC-based One-Time Password validation logic in keycloak-services. When a realm is configured with an HOTP policy, the operations to validate a submitted code and increment the HOTP counter are performed non-atomically and without concurrency locking. An attacker who has already obtained a valid users credentials and a single valid HOTP code can send multiple concurrent authentication requests to the OpenID Connect token endpoint. Because of the lack of synchronization, multiple requests may be validated against the same counter value before it is successfully incremented. This allows an attacker to bypass the one-time use restriction of the HOTP code and establish multiple concurrent authenticated sessions.