Executive brief
keycloak-connect is a Node.js library that provides authentication integration with Keycloak identity servers. A flaw in the logout endpoint fails to validate JWT signatures, allowing attackers to forge tokens and force user logouts or lock users out indefinitely by creating JWTs with future validity dates.
Technical details
keycloak-connect versions prior to 4.4.0 fail to validate JWT signatures on the /k_logout route, resulting in an authentication bypass vulnerability (CWE-287). An attacker can exploit this by crafting malicious JWTs with arbitrary NBF (not-before) claims and submitting them to the logout endpoint. The vulnerability allows forced logout of active users and can lock users out indefinitely by setting the NBF to a future date. The fix is available in version 4.4.0 and later.
Affected products
- Keycloak keycloak-connect prior to 4.4.0
Timeline
- 2019-06-13: disclosed
- 2019-06-13: patched: Fixed in version 4.4.0