CVE-2019-10157
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with loc…
Published: 2019-06-12 · CVSS: 4.7 · CVSS 3.0
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7