@aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3), @aerogear/voyager-keycloak (>=0.3.0-SNAPSHOT1, <=0.9.1-dev.435.8d846ff.0) +114 more potentially affected by CVE-2022-2237 via keycloak-connect (>=3.1.0, <=20.0.5)

keycloak-connect NPM version =3.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =1.0.0-alpha.0, =5.1.2, =0.1.0, =1.0.0, =1.1.1, =1.5.1, =0.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2022-2237 Source advisory: MEND:CVE-2022-2237...

Open Redirect

keycloak-connect is vulnerable to Open Redirect. The vulnerability exists in the module.exports function of the check-sso.js as it does not properly escape the slashes in the cleanUrl attribute, allowing an attacker to redirect the user to malicious urls with query param prompt=none when checking...

Authorization Bypass

keycloak-connect is vulnerable to authorization bypass. The vulnerability exists as the grant-manager middleware did not verify audience token before allowing access...

Denial Of Service (DoS)

keycloak-connect is vulnerable to denial of service. Failure to validate JWT signatures on /klogout route allows remote attackers to force logout users and indefinitely deny service to the application using malicious JWTs with NBF values...

Forced Logout

Overview Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to...

Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

GHSA-68HW-VFH7-XVG8 Forced Logout in keycloak-connect

Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +4 more potentially affected by CVE-2019-10157 via keycloak-connect (>=4.0.0-beta.1, <=4.5.0)

keycloak-connect NPM version =4.0.0-beta.1, =1.1.0, =0.0.2, =0.0.1, =0.0.1-alpha-1, =1.2.7 Source cves: CVE-2019-10157 Source advisory: GHSA-68HW-VFH7-XVG8...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +4 more potentially affected by CVE-2019-10157 via keycloak-connect (>=4.0.0-beta.1, <=4.5.0)

keycloak-connect NPM version =4.0.0-beta.1, =1.1.0, =0.0.2, =0.0.1, =0.0.1-alpha-1, =1.2.7 Source cves: CVE-2019-10157 Source advisory: OSV:GHSA-68HW-VFH7-XVG8...

@devsisters/passport (>=1.1.0, <=1.1.2), @project-sunbird/ext-framework-server (8.0.0) +13 more potentially affected by CVE-2019-10157 via keycloak-connect (>=3.1.0, <=4.5.0)

keycloak-connect NPM version =3.1.0, =1.1.0, =1.0.0, =0.0.1, =0.1.4, =3.2.0, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.5.2, =0.0.1-alpha-1, =0.0.1, =0.0.1, =1.0.42 - qb-passport-keycloak 1.0.0 Source cves: CVE-2019-10157 Source advisory: MEND:CVE-2019-10157...

PT-2019-11602

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 4.8.3 keycloak-connect versions prior to 4.4.0 Description: The issue is related to the improper verification of web tokens received from the server in the backchannel logout process. An attacker with local access...