Medium severity · published Oct 28, 2025
CVE-2025-12390
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
6.0
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.2 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
KE
keycloak · Keycloak
before 26.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12390
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12390
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:21370
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:21371
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22088
access.redhat.com
https://access.redhat.com/errata/RHSA-2025:22089
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-12390
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2406793
More from keycloak
8.8
CVE-2017-12161
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request
8.8
CVE-2014-3709
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…
8.1
CVE-2026-1609
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
7.5
CVE-2014-3651
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…
7.5
CVE-2017-12159
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session