PT-2025-44156 · Red Hat · Keycloak

Rmartinc · Published 2025-10-28 · Updated 2025-12-19 · CVE-2025-12390

Positive Technologies · (AI Summary)

CVSS v3.1

6.0

Medium

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in Keycloak that could allow a user to gain unintended access to another user's session when both users share the same device and browser. This occurs because Keycloak may reuse session identifiers and does not adequately clear sessions upon logout when browser cookies are absent. Consequently, a user might receive tokens intended for another user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-12390

GHSA-RG35-5V25-MQVP

Affected Products

Keycloak

References · 22

• https://access.redhat.com/errata/RHSA-2025:21371 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22088 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:22089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rg35-5v25-mqvp · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:21370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12390 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12390 · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/issues/43853 · Note
• https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80 · Note
• https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a · Note
• https://github.com/keycloak/keycloak/discussions/31265 · Note
• https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282 · Note
• https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d · Note
• https://github.com/keycloak/keycloak/issues/32197 · Note