This vulnerability arises from the Micrometer user-event metrics listener in Keycloak when configured to include the idp tag. An unauthenticated attacker can exploit this by sending requests to the identity broker login endpoint with arbitrary provider aliases, causing unbounded creation of metric time series. This resource exhaustion can degrade server and monitoring tool performance. The root cause is the lack of cardinality capping for the idp tag in the metrics event listener. Red Hat rates the severity as Moderate and notes that mitigation options are currently unavailable or unsuitable for widespread use.

Exploitation allows an unauthenticated attacker to cause resource exhaustion through excessive memory consumption, leading to degraded availability and performance of the Keycloak server and its monitoring tools. There is no impact on confidentiality or integrity. The attack complexity is high, and no privileges or user interaction are required.

Red Hat currently does not provide an official fix or effective mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates. Since the vulnerability requires explicit configuration of the Micrometer user-event metrics listener with the idp tag, disabling or avoiding this configuration may reduce exposure. No urgent remediation is available at this time.