Executive brief
Keycloak's Node.js authentication adapters failed to properly validate authentication tokens, allowing attackers to bypass login checks and gain unauthorized access to protected resources. This affects applications using Keycloak for centralized identity management, potentially exposing sensitive data and enabling further attacks without valid credentials.
Technical details
The vulnerability is a token validation bypass (CWE-253: Improper Check of Insufficient Control Flow Management) in the Node.js adapter's grant manager. The validateGrant() function did not properly check token expiration and validity, allowing attackers to supply invalid or expired tokens that would be accepted by the application. The flaw affects keycloak-connect and keycloak-js versions 2.5.0 through 3.0.x and requires no authentication or user interaction—any attacker with network access to the affected application can exploit it. By bypassing token validation, attackers gain unauthorized access to restricted functionality and data. The vulnerability was fixed in version 3.1.0.
Affected products
- Keycloak keycloak-connect 2.5.0 to 3.0.x
- Keycloak keycloak-js 2.5.0 to 3.0.x
Timeline
- 2017-04-25: disclosed: Vulnerability reported to Red Hat
- 2017-11-15: advisory: GHSA advisory published
- 2017-05-08: patched: Fix released in version 3.1.0; Red Hat RHSA-2017:1203 issued