{"action":"Upgrade keycloak-js to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"2.5.0"}],"component":"keycloak-js","cve_ids":["CVE-2017-7474"],"ecosystem":"npm","epss":0.02542,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-mw35-24gh-f82w","id":"tcs_01M5KG1VC6B7VHPD07T3YSZD5R","modified_at":"2023-11-08T03:59:24.497819Z","published_at":"2017-11-15T20:41:51Z","references":["https://osv.dev/vulnerability/GHSA-mw35-24gh-f82w","https://nvd.nist.gov/vuln/detail/CVE-2017-7474","https://bugzilla.redhat.com/show_bug.cgi?id=1445271","http://rhn.redhat.com/errata/RHSA-2017-1203.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-mw35-24gh-f82w#npm/keycloak-js","url":"https://osv.dev/vulnerability/GHSA-mw35-24gh-f82w"}],"summary":"keycloak-connect and keycloak-js improperly handle invalid tokens"}