{"id":"CVE-2026-118030","published":"2026-10-29T07:16:44.990","lastModified":"2026-10-29T07:16:45.103","description":"A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.","cvssScore":4.2,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-362"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118030","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562005","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}