Description
A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | all versions before 10.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | < 10.0.0 | 10.0.0 | GHSA-72j4-94rx-cr6w |