The vulnerability CVE-2024-1249 resides in the Keycloak project's OpenID Connect (OIDC) protocol implementation, within the checkLoginIframe functionality. Due to missing origin validation on incoming cross-origin messages, attackers can exploit this flaw to coordinate and send millions of requests in a short time frame, leading to significant degradation or denial of service of the affected application. This issue impacts Red Hat Single Sign-On 7.6 on RHEL 7 and 8. Red Hat has released security updates (rh-sso7-keycloak-18.0.13-1) that fix this vulnerability as part of their 7.6.8 release.

Exploitation of this vulnerability can result in a denial-of-service (DoS) condition by allowing attackers to flood the application with unvalidated cross-origin messages, overwhelming system resources. The CVSS 3.1 base score is 7.4 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality or integrity impact, but high impact on availability. There are no known exploits in the wild at this time.

Red Hat has released official security updates for Red Hat Single Sign-On 7.6.8 on RHEL 7 and 8 that address this vulnerability. Users should apply these updates promptly to remediate the issue. The advisories and updated packages are available at Red Hat's official errata pages (e.g., https://access.redhat.com/errata/RHSA-2024:1860 and https://access.redhat.com/errata/RHSA-2024:1861). Prior to applying the update, ensure all previous relevant errata are applied as per Red Hat guidance. No additional mitigation steps are indicated by the vendor.