keycloak-connect contains Open redirect vulnerability in the Node.js adapter

MEDIUM 6.1CVE-2022-2237 · GHSA-59fq-727j-hm3f · Published 27/03/2023 · updated 17/06/2026

In short

CVE-2022-2237 is a MEDIUM (CVSS 6.1) vulnerability affecting single sign-on (redhat), keycloak-connect.
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.2% of all vulnerabilities.
Fix: update to 21.0.1 or later.

Package	Affected versions	Patched versions
single sign-on redhat	`= 7.0`	No fix yet
keycloak-connect npm	`< 21.0.1`	`21.0.1`

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

References

keycloak/keycloak-nodejs-connect security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-2237 · ADVISORY
keycloak/keycloak-nodejs-connect commit 190a947 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
keycloak/keycloak-nodejs-connect · PACKAGE

More vulnerabilities in single sign-on

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

single sign-on

redhat

= 7.0

No fix yet

keycloak-connect

npm

< 21.0.1

21.0.1

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

More vulnerabilities in single sign-on

See all →