Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@keystone-6/auth

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1npmAmendedPublished

    @keystone-6/auth Open Redirect vulnerability

    CVE-2023-34247 · GHSA-jqxr-vjvv-899m

    Affected
    • npm @keystone-6/auth < 7.0.0
    Fixed in
    7.0.0· Vendor fix available
    Issue
    There is an open redirect in the @keystone-6/auth package, where the redirect leading / filter can be bypassed. Impact Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location. Mitigations - Don't use the @keystone-6/auth package References - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') - OWASP: Unvalidated Redirects and Forwards Cheat Sheet Similar Vulnerability Reports - CVE-2023-0748 - CVE-2022-2252 Credits Thanks to morioka12 for reporting this problem. If you have any questions around this security advisory, please don't hesitate to contact us at security@keystonejs.com, or open an issue on GitHub. If you have a security flaw to report for any software in this repository, please see our SECURITY policy.

    Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →