keycloak-connect contains Open redirect vulnerability in the Node.js adapter

MOYENNE 6.1CVE-2022-2237 · GHSA-59fq-727j-hm3f · Published 27/03/2023 · updated 17/06/2026

En bref

CVE-2022-2237 est une vulnérabilité MOYENNE (CVSS 6.1) touchant single sign-on (redhat), keycloak-connect.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.40%, plus élevée que 34.2% des vulnérabilités.
Correctif : mettre à jour vers 21.0.1 ou plus récent.

Package	Affected versions	Patched versions
single sign-on redhat	`= 7.0`	No fix yet
keycloak-connect npm	`< 21.0.1`	`21.0.1`

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

References

keycloak/keycloak-nodejs-connect security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-2237 · ADVISORY
keycloak/keycloak-nodejs-connect commit 190a947 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
keycloak/keycloak-nodejs-connect · PACKAGE

Autres vulnérabilités de single sign-on

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

single sign-on

redhat

= 7.0

No fix yet

keycloak-connect

npm

< 21.0.1

21.0.1

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

Autres vulnérabilités de single sign-on

Tout voir →