keycloak-connect and keycloak-js improperly handle invalid tokens (GHSA-mw35-24gh-f82w)
Published: 2017-11-15T20:41:51Z
Aliases: CVE-2017-7474
Severity: CRITICAL · CWE: CWE-253

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.  An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

Affected packages:
package: ecosystem: npm
name: keycloak-connect
ranges: type: ECOSYSTEM
events: introduced: 2.5.0
fixed: 3.1.0
package: ecosystem: npm
name: keycloak-js
ranges: type: ECOSYSTEM
events: introduced: 2.5.0
fixed: 3.1.0