Read the docs
TI-2022-02065 Aliases CVE-2022-2237GHSA-59fq-727j-hm3f

Open redirect in Keycloak

Priority LOW 27CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00399 34th percentileScored 2026-11-07
Fix Partial keycloak-connect (npm): 21.0.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Keycloakunknown—No fix listedCNA
—keycloak-connect (npm)before 21.0.121.0.1Patch availableGHSA-59fq-727j-hm3f
  • Keycloak Vendor— Affected unknown Fixed in — No fix listed CNA
  • keycloak-connect (npm) Vendor— Affected before 21.0.1 Fixed in 21.0.1 Patch available GHSA-59fq-727j-hm3f

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak_node.js_adapter:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak_node.js_adapter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-59fq-727j-hm3f keycloak-connect (npm) Fixed in 21.0.1 Advisory →

Red Hat 1 advisory

  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Not affected: 8 products
  • Red Hat AMQ Broker 7
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2237
  2. 2026-10-03 Alias added: GHSA-59fq-727j-hm3f

References

Advisory 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences