CVE-2017-7474 keycloak-connect and keycloak-js improperly handle invalid tokens
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm keycloak-connect(npm) | >= 2.5.0, < 3.1.0 | 3.1.0 |
| npm keycloak-js(npm) | >= 2.5.0, < 3.1.0 | 3.1.0 |
| keycloak-nodejs-auth-utils | = 2.5.0 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.0-cr1 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.1 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.2 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.3 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.4 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.5 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.6 | No fix listed |
| keycloak-nodejs-auth-utils | = 2.5.7 | No fix listed |
| keycloak-nodejs-auth-utils | = 3.0.0 | No fix listed |
| keycloak-nodejs-auth-utils | = 3.0.0-cr1 | No fix listed |
| redhat keycloak node.js adapter | = 2.5 - 3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- RHSA-2017:1203 vendor-advisory
- github.com