CVE-2019-10157: Forced Logout in keycloak-connect
Summary
CVE-2019-10157: Forced Logout in keycloak-connect. Affects keycloak-connect versions < 4.8.3. Fixed in 4.8.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The keycloak-connect package is an npm package used for integrating Keycloak authentication and authorization services into Node.js applications. It provides middleware and utilities to secure routes and manage user sessions. This package is vulnerable to a Forced Logout attack, where it fails to validate JWT signatures on the /k_logout route. This allows attackers to log out users and create malicious JWTs with NBF values that prevent user access indefinitely.
Vulnerability Detail
The vulnerability in keycloak-connect versions prior to 4.4.0 allows attackers to force user logout and manipulate JWTs to deny user access indefinitely. By exploiting the lack of JWT signature validation on the /k_logout route, an attacker can craft a malicious JWT with a Not Before (NBF) value that prevents the user from accessing the application. This can lead to unauthorized access and potential security breaches.
How To Fix
Latest published version: 26.1.1 as of 22 Oct 2026
npm install keycloak-connect@26.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.8.3
This is the first release that contains the fix.
npm install keycloak-connect@4.8.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The keycloak-connect package prior to version 4.4.0 is vulnerable to a Forced Logout attack. It is recommended to upgrade to version 4.4.0 or later to fix this vulnerability. For more information and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keycloak-connect →
FAQ
This vulnerability allows attackers to force user logout and deny user access indefinitely by manipulating JWTs. It can lead to unauthorized access and potential security breaches.
Versions prior to 4.4.0 of the keycloak-connect package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
Yes, the CVSS score for this vulnerability is 5.5.
For more information about this vulnerability, you can contact info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak-connect.
