CVE-2024-1249: keycloak Origin Validation Error
Vulnerability summary
CVE-2024-1249 is a high (CVSS 7.4) Origin Validation Error vulnerability in keycloak. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 17-04-2024PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- keycloak< 24.0.3-r0
Org.keycloak1 product
- keycloak-services< 22.0.10 | ≥ 23.0.0, < 24.0.3
Wolfi1 product
- keycloak< 24.0.3-r0
3 vendors · 3 products
References
20 linksShow all 20 references
- github.com/keycloak/keycloakPACKAGE