CVE-2025-12110

Published: Oct 23, 2025Modified: Jun 17, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (7)

https://access.redhat.com/errata/RHSA-2025:21370

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:21371

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:22088

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:22089

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-12110

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2406033

Source: secalert@redhat.com

https://github.com/keycloak/keycloak/pull/43790

Source: secalert@redhat.com

Timeline

No history available yet.