A vulnerability in the Micrometer user-event metrics listener of Keycloak allows an unauthenticated attacker to cause excessive memory consumption by sending requests with arbitrary provider aliases to the identity broker login endpoint when the listener is configured to include the idp tag. This results in the creation of an unlimited number of metric time series, degrading server and monitoring tool performance. The issue has a low severity rating and a CVSS score of 3.7. A security update is available in Red Hat build of Keycloak version 26.6.8 that addresses this flaw.