GHSA-mw35-24gh-f82w

ghsaUSosv

keycloak-connect and keycloak-js improperly handle invalid tokens

view advisory published 2017-11-15Licence: CC-BY-4.0

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-7474US	critical9.8	2.54% (85th)	—	2017-05-12
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restr…

references

External citations — patches, advisories, analysis.

http://rhn.redhat.com/errata/RHSA-2017-1203.htmlWEB
https://bugzilla.redhat.com/show_bug.cgi?id=1445271WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-7474ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan