TI-2023-17083 Aliases CVE-2023-34247 GHSA-jqxr-vjvv-899m

@keystone-6/auth Open Redirect vulnerability

LOW 27CWE-601Published 2023-06-13 · Updated 2025-01-03

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Keystone is a content management system for Node.JS. There is an open redirect in the `@keystone-6/auth` package versions 7.0.0 and prior, where the redirect leading `/` filter can be bypassed. Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. To mitigate this issue, one may apply a patch from pull request 8626 or avoid using the `@keystone-6/auth` package.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00407 35th percentileScored 2026-11-08

Fix Fixed @keystone-6/auth (npm): 7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
keystonejs	keystone	up to 7.0.0	—	No fix listed	CNA
—	@keystone-6/auth (npm)	before 7.0.0	7.0.0	Patch available	GHSA-jqxr-vjvv-899m

keystone Vendorkeystonejs Affected up to 7.0.0 Fixed in — No fix listed CNA
@keystone-6/auth (npm) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-jqxr-vjvv-899m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:keystonejs:keystone::::::node.js::*	up to 7.0.0	Vulnerable	keystonejs

cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:node.js:*:* Versions up to 7.0.0 Vulnerable ·keystonejs

Remediation

Fix · GHSA-jqxr-vjvv-899m @keystone-6/auth (npm) Fixed in 7.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-34247
2026-10-03 Alias added: GHSA-jqxr-vjvv-899m

References

Patch 1

https://github.com/keystonejs/keystone/pull/8626

Advisory 2

Other 1

https://github.com/keystonejs/keystone

TI-2022-18756 NODE_ENV in Keystone defaults to development with esbuild CVSS 3.1CRITICAL 9.8
TI-2022-18698 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field CVSS 3.1CRITICAL 9.8
TI-2017-11626 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in… CVSS 3.0HIGH 8.8
TI-2022-11852 An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1… CVSS 3.1CRITICAL 9.8
TI-2017-12181 KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF… CVSS 3.0HIGH 8.8
TI-2015-07619 Credentials management flaw in HackerOne keystone node module CVSS 3.0HIGH 7.5

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences