| Package | Affected versions | Patched versions |
|---|---|---|
| keycloak | < 4.8.3 | 4.8.3 |
| single sign-on | < 7.3.2 | 7.3.2 |
| keycloak-connect | < 4.8.3 | 4.8.3 |
Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /k_logout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.
Upgrade to version 4.4.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free