PT-2024-17623 · Red Hat · Keycloak

Tej Rathi · Published 2024-04-17 · Updated 2025-07-08 · CVE-2024-1249

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's OIDC component in the checkLoginIframe, which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-1249

GHSA-M6Q9-P373-G5Q8

RHSA-2024:1860

RHSA-2024:1861

RHSA-2024:1862

RHSA-2025:9582

RHSA-2025:9583

Affected Products

Keycloak

References · 28

• https://access.redhat.com/errata/RHSA-2024:2945 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1864 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1866 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:4057 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:9582 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1861 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1249 · Security Note
• https://access.redhat.com/errata/RHSA-2024:1860 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:9583 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1868 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:1862 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6q9-p373-g5q8 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/commit/9d9817e15a07195f16f554b7f60ee3a918369e26 · Note