GHSA-mw35-24gh-f82wCriticalCVSS 9.8

keycloak-connect and keycloak-js improperly handle invalid tokens

Published
November 15, 2017
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

CVE-2017-7474 →

📋 Description

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

🎯 Affected products2

  • npm/keycloak-connect:>= 2.5.0, < 3.1.0
  • npm/keycloak-js:>= 2.5.0, < 3.1.0

🔗 References (4)