CVEvulnerability

CVE-2017-7474

9.8 CRITICAL Published 2017-05-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-05-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-253

Description

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

Affected configurations

• keycloak keycloak-nodejs-auth-utils 2.5.0 • keycloak keycloak-nodejs-auth-utils 2.5.1 • keycloak keycloak-nodejs-auth-utils 2.5.2 • keycloak keycloak-nodejs-auth-utils 2.5.3 • keycloak keycloak-nodejs-auth-utils 2.5.4 • keycloak keycloak-nodejs-auth-utils 2.5.5 • keycloak keycloak-nodejs-auth-utils 2.5.6 • keycloak keycloak-nodejs-auth-utils 2.5.7 • keycloak keycloak-nodejs-auth-utils 3.0.0

Related

Weakness · CWE (1)

  • CWE-253 Incorrect Check of Function Return Value weakness

References