CVE-2020-1694CWE-183

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience

published September 16, 2020

CVSS
—
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01641 · 76.2th percentile
Weakness
CWE-183 · Permissive List of Allowed Inputs
Published
2020-09-16T18:03Z
EPSS history
Timeline
  • 16 SEP 18:03Z
    A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience
    cvelistv5