CVE-2025-12110
MEDIUM EPSS 18.9%
Published Oct 23, 20258mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Published Oct 23, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago
Description
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
18.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-613
References 7
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21370
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:21371
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:22088
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:22089
- access.redhat.com https://access.redhat.com/security/cve/CVE-2025-12110
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2406033
- github.com https://github.com/keycloak/keycloak/pull/43790
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.