Limzyallin

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the Micrometer user-event metrics listener when configured to include the `idp` tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, forcing the system to generate an unlimited number of metric time series. This results in excessive memory consumption and performance degradation for both the server and its monitoring tools. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.