Lucene search
GoogleOSV:GHSA-68HW-VFH7-XVG8HistoryJun 13, 2019 - 8:38 p.m.
Forced Logout in keycloak-connect
2019-06-1320:38:09
Google
osv.dev
12
EPSS
0
Percentile
5.1%
Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /k_logout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.
Recommendation
Upgrade to version 4.4.0 or later.
Related
redhatcve
redhatcve
CVE-2019-10157
2019-06-11 14:51:00
veracode
veracode
Denial Of Service (DoS)
2019-06-21 07:40:52
nodejs
nodejs
Forced Logout
2019-06-17 18:36:53
github
github
Forced Logout in keycloak-connect
2019-06-13 20:38:09
prion
prion
Code injection
2019-06-12 14:29:00
osv
osv
CVE-2019-10157
2019-06-12 14:29:02
nvd
nvd
CVE-2019-10157
2019-06-12 14:29:02
cve
cve
CVE-2019-10157
2019-06-12 14:29:02
cvelist
cvelist
CVE-2019-10157
2019-06-12 13:48:42
redhat
redhat
(RHSA-2019:1456) Moderate: Red Hat Single Sign-On 7.3.2 security update
2019-06-11 15:30:20