PT-2023-12689 · Red Hat · Keycloak Node.Js Adapter

Name of the Vulnerable Software and Affected Versions: Keycloak Node.js Adapter affected versions not specified Description: A flaw was found in the Keycloak Node.js Adapter, allowing an attacker to benefit from an Open Redirect vulnerability in the checkSso function. This issue is also present...

Open Redirect

doorkeeper-openidconnect is vulnerable to open redirect. The attack exists because it does not filter redirecturi in OAuth authorization request when handling custom parameters, causing an error response with the openid scope and a prompt=none value...

Design/Logic Flaw

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...