Detections
Analytics
CVE-2019-10157
medium
Description
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
References
https://github.com/advisories/GHSA-68hw-vfh7-xvg8
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0509