CVE-2017-7474

Published: May 12, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

Affected (11)

Products: Keycloak: Keycloak Nodejs Auth Utils

Keycloak

1 product

Keycloak Nodejs Auth Utils

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.0
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.0 cr1
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.1
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.2
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.3
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.4
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.5
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.6
Keycloak Keycloak Nodejs Auth Utils	Version 2.5.7
Keycloak Keycloak Nodejs Auth Utils	Version 3.0.0
Keycloak Keycloak Nodejs Auth Utils	Version 3.0.0 cr1

Related CWEs

CWE-253

Incorrect Check of Function Return Value

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

References (4)

http://rhn.redhat.com/errata/RHSA-2017-1203.html

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1445271

Source: secalert@redhat.com

Issue TrackingThird Party AdvisoryVDB Entry

http://rhn.redhat.com/errata/RHSA-2017-1203.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1445271

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party AdvisoryVDB Entry

Timeline

No history available yet.