VYPR
Get started
← All advisories
High severity7.4NVD Advisory· Published Apr 17, 2024· Updated Apr 15, 2026

CVE-2024-1249

CVE-2024-1249

Description

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 22.0.1022.0.10
org.keycloak:keycloak-servicesMaven
>= 23.0.0, < 24.0.324.0.3

Patches

2
9d9817e15a07

Limit requests sent through session status iframe (#132)

https://github.com/keycloak/keycloakJon KoopsMar 23, 2024via ghsa
commit
1 file changed · +8 −0
  • services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html+8 −0 modified
    @@ -28,6 +28,7 @@
       }
 
       let init;
+      let preventAdditionalRequests = false;
 
       async function checkState(clientId, origin, sessionState) {
         // Check if the browser has granted us access to 3rd-party storage (such as cookies).
@@ -41,6 +42,13 @@
 
         // If not initialized, verify this client is allowed access with a call to the server.
         if (!init) {
+          // Prevent additional requests to the server to avoid potential DoS attacks.
+          if (preventAdditionalRequests) {
+            return "error";
+          } else {
+            preventAdditionalRequests = true;
+          }
+
           const url = new URL(`${location.origin}${location.pathname}/init`);
 
           url.searchParams.set("client_id", clientId);
e3598a53678a

Limit requests sent through session status iframe (#118)

https://github.com/keycloak/keycloakJon KoopsMar 23, 2024via ghsa
commit
1 file changed · +8 −0
  • services/src/main/resources/org/keycloak/protocol/oidc/endpoints/login-status-iframe.html+8 −0 modified
    @@ -28,6 +28,7 @@
       }
 
       let init;
+      let preventAdditionalRequests = false;
 
       async function checkState(clientId, origin, sessionState) {
         // Check if the browser has granted us access to 3rd-party storage (such as cookies).
@@ -41,6 +42,13 @@
 
         // If not initialized, verify this client is allowed access with a call to the server.
         if (!init) {
+          // Prevent additional requests to the server to avoid potential DoS attacks.
+          if (preventAdditionalRequests) {
+            return "error";
+          } else {
+            preventAdditionalRequests = true;
+          }
+
           const url = new URL(`${location.origin}${location.pathname}/init`);
 
           url.searchParams.set("client_id", clientId);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.