CVE-2022-2237: Open Redirect Vulnerability in keycloak-connect
Summary
CVE-2022-2237: keycloak-connect contains Open redirect vulnerability in the Node.js adapter. Affects keycloak-connect versions < 21.0.1. Fixed in 21.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
keycloak-connect is an npm package that provides a Node.js adapter for integrating applications with Keycloak, an open-source identity and access management solution. It allows developers to secure their applications by handling authentication and authorization. However, a vulnerability has been discovered in the Node.js adapter of keycloak-connect that could potentially lead to an open redirect attack.
Vulnerability Detail
The vulnerability exists when forwarding requests to Keycloak using the checkSSO function with the query parameter prompt=none. This allows an attacker to manipulate the redirect URL and trick users into visiting malicious websites. By exploiting this vulnerability, an attacker could potentially steal sensitive information, perform phishing attacks, or redirect users to malicious content.
How To Fix
Latest published version: 26.1.1 as of 22 Oct 2026
npm install keycloak-connect@26.1.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
21.0.1
This is the first release that contains the fix.
npm install keycloak-connect@21.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the keycloak-connect package to the latest version as soon as possible.
Conclusion
The open redirect vulnerability in keycloak-connect can have serious security implications, potentially leading to the compromise of user information or the execution of malicious actions. It is crucial for developers to update their keycloak-connect package to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keycloak-connect →
FAQ
keycloak-connect is an npm package that provides a Node.js adapter for integrating applications with Keycloak, an open-source identity and access management solution.
An open redirect vulnerability occurs when a web application allows an attacker to redirect users to external websites without proper validation. This can be exploited to trick users into visiting malicious websites or phishing pages.
By manipulating the redirect URL in requests to Keycloak using the checkSSO function with the prompt=none query parameter, an attacker can redirect users to malicious websites or phishing pages.
This vulnerability could lead to sensitive information being stolen, users being tricked into visiting malicious websites, or being redirected to phishing pages where their credentials could be compromised.
Yes, developers should update their keycloak-connect package to version 21.0.1 or later to fix this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for keycloak-connect.
