7.5
CVSSv2

CVE-2017-7474

Published: 12/05/2017 Updated: 03/10/2019
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

Vulnerable Product Search on Vulmon Subscribe to Product

keycloak keycloak-nodejs-auth-utils 2.5.2

keycloak keycloak-nodejs-auth-utils 2.5.3

keycloak keycloak-nodejs-auth-utils 2.5.4

keycloak keycloak-nodejs-auth-utils 2.5.0

keycloak keycloak-nodejs-auth-utils 2.5.7

keycloak keycloak-nodejs-auth-utils 3.0.0

keycloak keycloak-nodejs-auth-utils 2.5.1

keycloak keycloak-nodejs-auth-utils 2.5.5

keycloak keycloak-nodejs-auth-utils 2.5.6

Vendor Advisories

Synopsis Important: Red Hat Single Sign-On Nodejs adapter security update Type/Severity Security Advisory: Important Topic An update to the Nodejs adapter for Red Hat Single Sign-On 71 is now available from the Customer PortalRed Hat Product Security has rated this update as having a security impact of ...
It was found that the Keycloak Nodejs adapter did not handle invalid tokens correctly An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks ...