Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-1249— Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Quick assessment

Affected

CVE-2024-1249

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat Keycloak是美国红帽（Red Hat）公司的一套为现代应用和服务提供身份验证和管理功能的软件。 Red Hat Keycloak 存在安全漏洞，该漏洞源于允许未经验证的跨域消息，允许攻击者使用简单的代码在几秒钟内协调和发送数百万个请求。

CVSS 7.4 · High EPSS 0.44% · P36 Updated Sep 09, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 42

Vendor	Product	Version Range	Status
None	None	`21.1.0< 22.0.10`	affected
		`23.0.0< 24.0.3`	affected
Red Hat	Migration Toolkit for Applications 6	`any`	affected
Red Hat	Migration Toolkit for Applications 7	`any`	unaffected
Red Hat	Red Hat AMQ Broker 7	`any`	unaffected
Red Hat	Red Hat build of Apicurio Registry 2	`any`	affected
Red Hat	Red Hat build of Keycloak 22	`22.0.10-1< *`	unaffected
		`22-13< *`	unaffected
		`22-16< *`	unaffected
Red Hat	Red Hat build of Keycloak 22.0.10	`any`	unaffected
Red Hat	Red Hat Data Grid 8	`any`	unaffected
Red Hat	Red Hat Decision Manager 7	`any`	affected
Red Hat	Red Hat Developer Hub	`any`	unaffected
Red Hat	Red Hat Fuse 7	`any`	unaffected
Red Hat	Red Hat JBoss Data Grid 7	`any`	unaffected
Red Hat	Red Hat JBoss Enterprise Application Platform 6	`any`	unknown
		`any`	unknown
		`any`	unknown
		`any`	unknown
		`any`	unknown
		`any`	unknown
		`any`	unknown
		`any`	unknown
Red Hat	Red Hat JBoss Enterprise Application Platform 7	`any`	affected
Red Hat	Red Hat JBoss Enterprise Application Platform 8	`any`	unaffected
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	`any`	unaffected
Red Hat	Red Hat Process Automation 7	`any`	affected
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	`0:18.0.13-1.redhat_00001.1.el7sso< *`	unaffected
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	`0:18.0.13-1.redhat_00001.1.el8sso< *`	unaffected
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	`0:18.0.13-1.redhat_00001.1.el9sso< *`	unaffected
Red Hat	RHEL-8 based Middleware Containers	`7.6-46< *`	unaffected
Red Hat	RHOSS-1.33-RHEL-8	`1.33.0-5< *`	unaffected
		`1.33.0-5< *`	unaffected
		`1.33.0-5< *`	unaffected
		`1.33.0-5< *`	unaffected
		`1.33.0-5< *`	unaffected
		`1.33.0-5< *`	unaffected
		`1.33.0-3< *`	unaffected
		`1.33.0-5< *`	unaffected
… +1 more rows
Red Hat	RHSSO 7.6.8	`any`	unaffected
Red Hat	streams for Apache Kafka	`any`	unaffected

I. Basic Information for CVE-2024-1249

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

源验证错误

Source: CVE Program / CVE List V5

Vulnerability Title

Red Hat Keycloak 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
-	-	21.1.0 ~ 22.0.10	-
Red Hat	Red Hat AMQ Broker 7	-	`cpe:/a:redhat:amq_broker:7.12`
Red Hat	Red Hat build of Keycloak 22	22.0.10-1 ~ *	`cpe:/a:redhat:build_keycloak:22::el9`
Red Hat	Red Hat build of Keycloak 22	22-13 ~ *	`cpe:/a:redhat:build_keycloak:22::el9`
Red Hat	Red Hat build of Keycloak 22	22-16 ~ *	`cpe:/a:redhat:build_keycloak:22::el9`
Red Hat	Red Hat build of Keycloak 22.0.10	-	`cpe:/a:redhat:build_keycloak:22`
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	0:18.0.13-1.redhat_00001.1.el7sso ~ *	`cpe:/a:redhat:red_hat_single_sign_on:7.6::el7`
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	0:18.0.13-1.redhat_00001.1.el8sso ~ *	`cpe:/a:redhat:red_hat_single_sign_on:7.6::el8`
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	0:18.0.13-1.redhat_00001.1.el9sso ~ *	`cpe:/a:redhat:red_hat_single_sign_on:7.6::el9`
Red Hat	RHEL-8 based Middleware Containers	7.6-46 ~ *	`cpe:/a:redhat:rhosemc:1.0::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-3 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHOSS-1.33-RHEL-8	1.33.0-5 ~ *	`cpe:/a:redhat:openshift_serverless:1.33::el8`
Red Hat	RHSSO 7.6.8	-	`cpe:/a:redhat:red_hat_single_sign_on:7.6`
Red Hat	Migration Toolkit for Applications 6	-	`cpe:/a:redhat:migration_toolkit_applications:6`
Red Hat	Migration Toolkit for Applications 7	-	`cpe:/a:redhat:migration_toolkit_applications:7`
Red Hat	Red Hat build of Apicurio Registry 2	-	`cpe:/a:redhat:service_registry:2`
Red Hat	Red Hat Data Grid 8	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat Decision Manager 7	-	`cpe:/a:redhat:jboss_enterprise_brms_platform:7`
Red Hat	Red Hat Developer Hub	-	`cpe:/a:redhat:rhdh:1`
Red Hat	Red Hat Fuse 7	-	`cpe:/a:redhat:jboss_fuse:7`
Red Hat	Red Hat JBoss Data Grid 7	-	`cpe:/a:redhat:jboss_data_grid:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 6	-	`cpe:/a:redhat:jboss_enterprise_application_platform:6`
Red Hat	Red Hat JBoss Enterprise Application Platform 6	-	`cpe:/a:redhat:jboss_enterprise_application_platform:6`

II. Public POCs for CVE-2024-1249

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-1249

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-1249 (12)

https://access.redhat.com/security/cve/CVE-2024-1249 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2262918 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4057 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:1861 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:1864 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2024:1868 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
🔗 RHSA-2025:9583 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2945 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:1860 vendor-advisory x_refsource_REDHAT
🔗 RHSA-2024:1866 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
🔗 RHSA-2025:9582 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:1862 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2024-1249

IV. Related Vulnerabilities

Same weakness: CWE-346

V. Comments for CVE-2024-1249

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-1249— Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 42

I. Basic Information for CVE-2024-1249

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-1249

III. Intelligence Information for CVE-2024-1249

Vendor Advisories for CVE-2024-1249 (12)

IV. Related Vulnerabilities

V. Comments for CVE-2024-1249

Leave a comment