CVE-2026-101333

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Micrometer user-event metrics listener when configured to include the idp tag. An unauthenticated attacker can send requests to the identity broker login endpoint using arbitrary provider aliases, forcing the system to generate an unlimited number of metric time series. This results in excessive memory consumption and performance degradation for both the server and its monitoring tools.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.