CVE-2026-118030 Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118030?
CVE-2026-118030 is a medium-severity vulnerability in Red Hat Build of Keycloak, published on 29 Oct 2026.
Official description
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Weakness: CWE-362
Which versions are affected by CVE-2026-118030?
How do I fix CVE-2026-118030?
No fix has been published for CVE-2026-118030 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118030 being exploited?
There is no known exploitation of CVE-2026-118030 in the wild and no public exploit code.
Sources
Also known as GHSA-hx7p-ffjf-vx59.