Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
CVE-2025-12390: Keycloak: Unauthorized Access to Other Users' Sessions on Shared Devices
CVE-2025-12390 · published 1 year ago
Summary
Keycloak, a widely used identity management system, has a flaw that could allow one user to access another user's session if they share the same device and browser. This can happen when a user logs out but doesn't properly clear browser cookies, allowing the next user to inherit the old session. To mitigate this risk, users should clear their browser cookies when logging out of Keycloak or use a private browser window.
What to do
- Update keycloak org.keycloak:keycloak-services to version 26.0.0.
- Update keycloak keycloak to version 26.0.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | keycloak | org.keycloak:keycloak-services |
< 26.0.0 Fix: upgrade to 26.0.0
|
| – | keycloak | keycloak | < 26.0.0 |
| – | red hat | red hat build of keycloak 26.2 | All versions |
| – | red hat | red hat build of keycloak 26.2.11 | All versions |
| – | red hat | red hat build of keycloak 26.4 | All versions |
| – | red hat | red hat build of keycloak 26.4.4 | All versions |
Original advisory text
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
References
- https://github.com/keycloak/keycloak/issues/32197
- https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b...
- https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee...
- https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a...
- https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2...
- https://github.com/keycloak/keycloak/discussions/31265
- https://github.com/advisories/GHSA-rg35-5v25-mqvp
- https://nvd.nist.gov/vuln/detail/CVE-2025-12390 Vendor Advisory
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://catalog.redhat.com/software/containers/ URL
- https://access.redhat.com/errata/RHSA-2025:21370 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2025:21371 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2025:22088 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2025:22089 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-12390 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12390... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2406793 Third Party Advisory
- https://github.com/keycloak/keycloak/issues/43853 Third Party Advisory
- https://github.com/keycloak/keycloak Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-384Session Fixation
Timeline
Published28 Oct 2025
Updated26 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta