GHSA-68hw-vfh7-xvg8MediumCVSS 5.5

Forced Logout in keycloak-connect

Published
June 13, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-10157 →

📋 Description

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /k_logout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.

Recommendation

Upgrade to version 4.4.0 or later.

🎯 Affected products1

  • npm/keycloak-connect:< 4.8.3

🔗 References (7)