How severe is CVE-2024-1722?

CVE-2024-1722 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2024-1722 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-1722?

CVE-2024-1722 affects Redhat Keycloak. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-1722?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-1722 have an EU (EUVD) identifier?

Yes. CVE-2024-1722 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2026.

When was CVE-2024-1722 published?

CVE-2024-1722 was published on 2024-02-29 and last updated on 2026-06-17.

CVE-2024-1722

CVE-2024-1722 is a low-severity vulnerability in Redhat Keycloak with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-645.

Key facts

Severity: Low (CVSS 3.x base score 3.7)
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-2026
Weakness: CWE-645
Affected product: Redhat Keycloak
Published: 2024-02-29
Last modified: 2026-06-17

Description

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.

Frequently asked questions

What is CVE-2024-1722?: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
How severe is CVE-2024-1722?: CVE-2024-1722 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2024-1722 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-1722?: CVE-2024-1722 affects Redhat Keycloak. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-1722?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-1722 have an EU (EUVD) identifier?: Yes. CVE-2024-1722 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-2026.
When was CVE-2024-1722 published?: CVE-2024-1722 was published on 2024-02-29 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:redhat:keycloak:23.0.5:*:*:*:*:*:*:*

More vulnerabilities in Redhat Keycloak

CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…
CVE-2022-1245 — Critical (CVSS 9.8): A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client…
CVE-2019-14910 — Critical (CVSS 9.8): A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used…
CVE-2021-20195 — Critical (CVSS 9.6): A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete…
CVE-2022-3782 — Critical (CVSS 9.1): keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate…
CVE-2019-14837 — Critical (CVSS 9.1): A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this…

All CVEs affecting Redhat Keycloak →

Other CWE-645 vulnerabilities

CVE-2023-4346 — High (CVSS 7.5): KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable…
CVE-2026-53982 — Medium (CVSS 6.5): Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an…
CVE-2025-31947 — Medium (CVSS 5.8): Mattermost versions 10.6.x <= 10.6.1, 10.5.x <= 10.5.2, 10.4.x <= 10.4.4, 9.11.x <= 9.11.11 fail to lockout LDAP users…
CVE-2026-25907 — Medium (CVSS 5.3): Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An…
CVE-2025-5241 — Medium (CVSS 5.3): Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows…

Browse all CWE-645 vulnerabilities →