CVE-2019-10157 – keycloak: Node.js adapter internal NBF can be manipulated leading to DoS.

https://notcve.org/view.php?id=CVE-2019-10157

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely. Se encontró que el adaptador Node.js de Keycloak antes de la versión 4.8.3 no verificó correctamente el token web recibido del servidor en su cierre de sesión de backchannel. Un atacante con acceso local podría usar esto para construir un token web malicioso que establezca un parámetro NBF que podría impedir el acceso de los usuarios de forma indefinida. It was found that Keycloak's Node.js adapter did not properly verify the web token received from the server in its backchannel logout. • http://www.securityfocus.com/bid/108734 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157 https://access.redhat.com/security/cve/CVE-2019-10157 https://bugzilla.redhat.com/show_bug.cgi?id=1702953 • CWE-287: Improper Authentication CWE-345: Insufficient Verification of Data Authenticity •