PT-2024-17623

CVE-2024-1249

Published

2024-04-17

Updated

2025-07-08

Description by

CVSS 3.1

7.4

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's OIDC component in the checkLoginIframe, which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Tej Rathi

Vendors

Affected products

Weakness enumeration

CWE-346: Origin Validation Error

Related identifiers

CVE-2024-1249