GitHub Advisoryadvisory · npm

GHSA-68hw-vfh7-xvg8 Forced Logout in keycloak-connect

MEDIUM Published 2019-06-13 Modified 2021-08-16 Official page ↗
Aliases
CVE-2019-10157
Ecosystem
npm
Packages
keycloak-connect
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287, CWE-345
Reviewed
2019-06-13

Affected packages

• npm keycloak-connect: < 4.8.3 → fixed in 4.8.3

Description

Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4.0 or later.

Related

Alias · CVE (1)

  • CVE-2019-10157 It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References