CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-7474
Critical (9.8) in keycloak keycloak-nodejs-auth-utils. EPSS 2.5% chance of exploitation in the next 30 days. Fixed in keycloak-connect 3.1.0.
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Severity
- EPSS
- 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-253
- Published
- Modified
- Record from
- the NVD, synced
Affected
- keycloak:keycloak-nodejs-auth-utils
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mw35-24gh-f82w | npm | keycloak-connect | >=2.5.0 <3.1.0 | 3.1.0 |
| GHSA-mw35-24gh-f82w | npm | keycloak-js | >=2.5.0 <3.1.0 | 3.1.0 |