MEDIUM6.1
GHSA-59fq-727j-hm3f
keycloak-connect contains Open redirect vulnerability in the Node.js adapter
Quick fix
GHSA-59fq-727j-hm3f — keycloak-connect: upgrade to the fixed version with the command below.
npm install keycloak-connect@21.0.1Details
There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using `checkSSO` with query param `prompt=none`.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2022-2237[ADVISORY]
- https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2097007[WEB]
- https://github.com/keycloak/keycloak-nodejs-connect[PACKAGE]