CVE-2019-10157: Red Hat Keycloak

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

Affected products

• Red Hat Keycloak: before 4.8.3 (fixed in 4.8.3)
• Red Hat Single Sign-On: before 7.3.2 (fixed in 7.3.2)

Published 2019-06-12. Last modified 2026-06-17.