Description
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Keycloak Node.js adapter | 2.5 - 3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | keycloak-connect | >= 2.5.0, < 3.1.0 | 3.1.0 | GHSA-mw35-24gh-f82w |
| npm | keycloak-js | >= 2.5.0, < 3.1.0 | 3.1.0 | GHSA-mw35-24gh-f82w |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1445271
- RHSA-2017:1203 vendor-advisory