CVE-2020-1744: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2020-1744) was discovered in Keycloak versions prior to 9.0.1. The flaw occurs when configuring a Conditional OTP Authentication Flow as a post login flow of an IDP, where failed login events for OTP are not sent to the brute force protection event queue, resulting in the BruteForceProtector not handling these events (NVD, Red Hat).

The vulnerability has been assigned a CVSS v3.1 base score of 5.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The issue specifically affects the authentication flow mechanism in Keycloak, where the failure to send OTP login events to the brute force protection queue creates a security gap in the authentication process (NVD).

The vulnerability could potentially allow attackers to bypass brute force protection mechanisms specifically for OTP authentication attempts, as failed login events are not properly tracked and handled by the BruteForceProtector (Red Hat).

The vulnerability was fixed in Keycloak version 9.0.1. Users are advised to upgrade to this version or later. Red Hat has released several security advisories (RHSA-2020:0945, RHSA-2020:0946, RHSA-2020:0947) to address this issue across different platforms (Red Hat).