Description
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Keycloak | keycloak | < 26.0.0 | 26.0.0 |
| Red Hat | Red Hat build of Keycloak 26.2 | — | — |
| Red Hat | Red Hat build of Keycloak 26.2.11 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4 | — | — |
| Red Hat | Red Hat build of Keycloak 26.4.4 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 26.0.0 | 26.0.0 | GHSA-rg35-5v25-mqvp |
Advisories 1
- WID-SEC-2025-2438 Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 13, 2025
References
- RHSA-2025:21370 vendor-advisory
- RHSA-2025:21371 vendor-advisory
- RHSA-2025:22088 vendor-advisory
- RHSA-2025:22089 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-12390 vdb-entry
- RHBZ#2406793 issue-tracking
- https://github.com/keycloak/keycloak/issues/43853