keycloak-connect contains Open redirect vulnerability in the Node.js adapter

보통 6.1CVE-2022-2237 · GHSA-59fq-727j-hm3f · Published 27/03/2023 · updated 17/06/2026

요약

CVE-2022-2237은(는) single sign-on (redhat), keycloak-connect에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.40%, 전체 취약점의 34.2%보다 높음.
조치: 21.0.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
single sign-on redhat	`= 7.0`	No fix yet
keycloak-connect npm	`< 21.0.1`	`21.0.1`

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

References

keycloak/keycloak-nodejs-connect security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-2237 · ADVISORY
keycloak/keycloak-nodejs-connect commit 190a947 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
keycloak/keycloak-nodejs-connect · PACKAGE

single sign-on의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

single sign-on

redhat

= 7.0

No fix yet

keycloak-connect

npm

< 21.0.1

21.0.1

Description

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none.

NVD description

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

single sign-on의 다른 취약점

모두 보기 →