CVE-2017-7474: Critical severity Keycloak keycloak-nodejs-auth-utils vulnerability
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Other sources
the nodejs auth-utils grant manager causes token validity to be ignored during validateGrant().
upstream jira KEYCLOAK-4771 pull request: https://github.com/keycloak/keycloak-nodejs-auth-utils/pull/49
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7474?
CVE-2017-7474 has a medium severity rating due to its potential for authentication bypass.
How do I fix CVE-2017-7474?
To fix CVE-2017-7474, upgrade to Keycloak Node.js adapter version 3.1.0 or later.
What versions are affected by CVE-2017-7474?
CVE-2017-7474 affects Keycloak Node.js adapter versions 2.5.0 through 3.0.0.
What could an attacker do with CVE-2017-7474?
An attacker could exploit CVE-2017-7474 to bypass authentication and access restricted information.
Is CVE-2017-7474 exploitable in production environments?
Yes, CVE-2017-7474 is exploitable in production environments if the affected versions are in use.