This vulnerability arises from the use of unsanitized, request-controlled input within Prometheus metric labels in Keycloak's user-event metrics recording. Specifically, error messages from failed account operations, which may contain user-supplied data such as nonexistent client IDs, are recorded as metric labels without proper sanitization. An authenticated user with low privileges but specific account management permissions can exploit this to create an unbounded number of unique metric time series, leading to memory exhaustion and service unavailability. Red Hat has assessed the severity as moderate and has not provided an official fix or effective mitigation that meets their criteria for ease of use and applicability.

Successful exploitation allows an authenticated user with specific account management permissions to cause a denial of service by exhausting system memory. The vulnerability does not impact confidentiality or integrity but results in high availability impact due to service crashes or unavailability. There are no known exploits in the wild at this time.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for deployment and stability. Users should monitor the Red Hat advisory for updates. Until a fix is available, restricting authenticated user permissions to limit access to account management features may reduce risk. No other vendor-recommended mitigations are currently available.