It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Keycloak-nodejs-auth-utils | Keycloak | 2.5.0 (including) | 2.5.0 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.0-cr1 (including) | 2.5.0-cr1 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.1 (including) | 2.5.1 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.2 (including) | 2.5.2 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.3 (including) | 2.5.3 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.4 (including) | 2.5.4 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.5 (including) | 2.5.5 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.6 (including) | 2.5.6 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 2.5.7 (including) | 2.5.7 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 3.0.0 (including) | 3.0.0 (including) |
Keycloak-nodejs-auth-utils | Keycloak | 3.0.0-cr1 (including) | 3.0.0-cr1 (including) |