Insufficient session expiration in keycloak
Priority LOW 24CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed keycloak (Keycloak): 26.4.3org.keycloak:keycloak-services (Maven): 26.2.3Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Keycloak | keycloak | before 26.4.3 | 26.4.3 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.2 | — | 26.2.11-1 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.2 | — | 26.2-12 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.2 | — | 26.2-12 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.2.11 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4.4-1 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4-3 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4 | — | 26.4-3 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 26.4.4 | — | — | Not affected | CNA |
| — | org.keycloak:keycloak-services (Maven) | before 26.2.3 | 26.2.3 | Patch available | GHSA-895x-rfqp-jh5c |
- keycloak VendorKeycloak Affected before 26.4.3 Fixed in 26.4.3 Patch available CNA
- Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2.11-1 Patch available CNA
- Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-12 Patch available CNA
- Red Hat build of Keycloak 26.2 VendorRed Hat Affected — Fixed in 26.2-12 Patch available CNA
- Red Hat build of Keycloak 26.2.11 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4.4-1 Patch available CNA
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-3 Patch available CNA
- Red Hat build of Keycloak 26.4 VendorRed Hat Affected — Fixed in 26.4-3 Patch available CNA
- Red Hat build of Keycloak 26.4.4 VendorRed Hat Affected — Fixed in — Not affected CNA
- org.keycloak:keycloak-services (Maven) Vendor— Affected before 26.2.3 Fixed in 26.2.3 Patch available GHSA-895x-rfqp-jh5c
Remediation
- Fix · CNA keycloak (Keycloak) Fixed in 26.4.3
- Fix · GHSA-895x-rfqp-jh5c org.keycloak:keycloak-services (Maven) Fixed in 26.2.3 Advisory →
Red Hat 4 advisories
- RHSA-2025:22088 Released 2025-11-25 · Red Hat rating ModerateRed Hat build of Keycloak 26.2.11 Images Security Update
- Red Hat build of Keycloak 26.2 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2025:22089 Released 2025-11-25 · Red Hat rating ModerateRed Hat build of Keycloak 26.2.11 Security Update
- Red Hat build of Keycloak 26.2.11
- RHSA-2025:21371 Released 2025-11-13 · Red Hat rating ModerateRed Hat build of Keycloak 26.4.4 Images Security Update
- Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Show 1 more Red Hat advisories
- RHSA-2025:21370 Released 2025-11-13 · Red Hat rating ModerateRed Hat build of Keycloak 26.4.4 Security Update
- Red Hat build of Keycloak 26.4.4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat build of Keycloak 26.2 | Fixed | RHSA-2025:22088 |
| Red Hat build of Keycloak 26.2.11 | Fixed | RHSA-2025:22089 |
| Red Hat build of Keycloak 26.4 | Fixed | RHSA-2025:21371 |
| Red Hat build of Keycloak 26.4.4 | Fixed | RHSA-2025:21370 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-12110
- 2026-10-03 Alias added: GHSA-895x-rfqp-jh5c
References
Advisory 5
Other 6
- https://access.redhat.com/security/cve/CVE-2025-12110
- RHBZ#2406033
- https://github.com/keycloak/keycloak/pull/43790
- https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
- https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
- https://github.com/keycloak/keycloak
More Keycloak vulnerabilities
- TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
- TI-2017-05120 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens… CVSS 3.0CRITICAL 9.8
- TI-2017-08952 Weak password recovery in Red Hat Keycloak CVSS 3.0HIGH 8.8
- TI-2014-03024 The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak… CVSS 3.0HIGH 8.8
- TI-2026-01295 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users CVSS 3.1HIGH 8.1
- TI-2017-08950 Insufficient session expiration in Red Hat keycloak CVSS 3.0HIGH 7.5
Sources
- CVE-2025-12110 · CVE Program
- CVE-2025-12110 · NVD
- FIRST EPSS
- GHSA-895x-rfqp-jh5c · GitHub Advisory Database · CC BY 4.0
- CVE-2025-12110 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences