Open Redirect

keycloak-connect is vulnerable to Open Redirect. The vulnerability exists in the module.exports function of the check-sso.js as it does not properly escape the slashes in the cleanUrl attribute, allowing an attacker to redirect the user to malicious urls with query param prompt=none when checking...

@aerogear/voyager-keycloak (>=0.8.1-dev.422.e25a8f8.0 <=0.9.1-dev.435.8d846ff.0), @aerogear/voyager-server (>=0.8.1-dev.414.e43c5aa.0 <=0.9.1-dev.435.8d846ff.0) +70 more potentially affected by CVE-2022-2237 via keycloak-connect (>=10.0.2 <=20.0.5)

keycloak-connect NPM version =10.0.2, =0.8.1-dev.422.e25a8f8.0, =0.8.1-dev.414.e43c5aa.0, =0.8.1-dev.414.e43c5aa.0, =1.0.0-alpha.0, =5.1.2, =0.1.0, =0.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.3, =1.0.3, =1.1.7 and more Source cves: CVE-2022-2237 Source advisory: OSV:GHSA-59FQ-727J-HM3F...

Authorization Bypass

keycloak-connect is vulnerable to authorization bypass. The vulnerability exists as the grant-manager middleware did not verify audience token before allowing access...

Denial Of Service (DoS)

keycloak-connect is vulnerable to denial of service. Failure to validate JWT signatures on /klogout route allows remote attackers to force logout users and indefinitely deny service to the application using malicious JWTs with NBF values...

Forced Logout

Overview Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to...

GHSA-68HW-VFH7-XVG8 Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...