CVE-2025-12390 | BDVDB-2026-299779 Detail
Keycloakkeycloak
Description#
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: local.
Weaknesses#
- CWE-384 Session Fixation
References#
- https://access.redhat.com/errata/RHSA-2025:21370
- https://access.redhat.com/errata/RHSA-2025:21371
- https://access.redhat.com/errata/RHSA-2025:22088
- https://access.redhat.com/errata/RHSA-2025:22089
- https://access.redhat.com/security/cve/CVE-2025-12390
- https://bugzilla.redhat.com/show_bug.cgi?id=2406793
- https://github.com/keycloak/keycloak/issues/43853
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.