This vulnerability arises from the way Keycloak records user-event metrics when metrics are enabled. Specifically, raw error messages from failed account operations are used directly as Prometheus metric labels without sanitization. Because these error messages can contain user-controlled input such as nonexistent client IDs, an authenticated user with account management permissions can generate a very large number of unique metric entries. This unbounded metric cardinality can exhaust system memory, leading to a denial of service by crashing or making the service unavailable. The root cause is the use of unsanitized, request-controlled input in Prometheus metric labels. Red Hat has assessed this vulnerability as Moderate severity and has not provided an official fix or mitigation that meets their deployment and stability criteria as of the advisory date.

Successful exploitation requires an authenticated user with specific account management permissions. The attacker can cause a denial of service by exhausting system memory through the creation of an unbounded number of Prometheus metric time series. There is no impact on confidentiality or integrity, but availability is highly impacted due to potential service crashes or unavailability.

Currently, there is no official fix or mitigation available from Red Hat that meets their criteria for ease of use, deployment, and applicability. Users should monitor Red Hat's security advisories for updates or patches addressing this vulnerability. Until a fix is available, limiting access to users with account management permissions and disabling metrics if feasible may reduce exposure.