Security Advisory

CVE-2019-10157

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2019-06-12 13:48:42

Last updated 2024-08-04 22:10:10

Assigner redhat

CVSS score 4.7

State PUBLISHED

Description

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

← Browse all CVEs View on cve.org ↗