GitHub Advisoryadvisory · npm

GHSA-mw35-24gh-f82w keycloak-connect and keycloak-js improperly handle invalid tokens

CRITICAL Published 2017-11-15 Modified 2023-09-08 Official page ↗
Aliases
CVE-2017-7474
Ecosystem
npm
Packages
keycloak-connect, keycloak-js
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-253
Reviewed
2020-06-16

Affected packages

• npm keycloak-connect: >= 2.5.0, < 3.1.0 → fixed in 3.1.0 • npm keycloak-js: >= 2.5.0, < 3.1.0 → fixed in 3.1.0

Description

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

Related

Alias · CVE (1)

  • CVE-2017-7474 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. vulnerability

Weakness · CWE (1)

  • CWE-253 Incorrect Check of Function Return Value weakness

References