Re: [keycloak-dev] Critical vulnerabilities in JSON Web Token libraries

It seems to me that we are not vulnerable to this. We're using RSATokenVerifier everywhere and only allowed algorithms are the RS256, RS384, RS512. And for all of them, attacker would need realm private key to sign the token. Marek On 2.4.2015 20:54, Pedro Igor Silva wrote: