GitHub Advisoryadvisory · Maven
GHSA-rg35-5v25-mqvp Keycloak vulnerable to session takeovers due to reuse of session identifiers
MEDIUM
Official page ↗
- Aliases
- CVE-2025-12390
- Ecosystem
- Maven
- Packages
- org.keycloak:keycloak-services
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-384
- Reviewed
- 2025-10-29
Affected packages
• Maven org.keycloak:keycloak-services: < 26.0.0 → fixed in 26.0.0
Description
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Related
Alias · CVE (1)
- CVE-2025-12390 A flaw was found in Keycloak. vulnerability
Weakness · CWE (1)
- CWE-384 Session Fixation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-12390 advisory
- https://github.com/keycloak/keycloak/issues/32197 web
- https://github.com/keycloak/keycloak/issues/43853 web
- https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282 web
- https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a web
- https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d web
- https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80 web
- https://access.redhat.com/errata/RHSA-2025:21370 web
- https://access.redhat.com/errata/RHSA-2025:21371 web
- https://access.redhat.com/errata/RHSA-2025:22088 web
- https://access.redhat.com/errata/RHSA-2025:22089 web
- https://access.redhat.com/security/cve/CVE-2025-12390 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2406793 web
- https://github.com/keycloak/keycloak package
- https://github.com/keycloak/keycloak/discussions/31265 web