CVE-2025-12110
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Severity
MEDIUM
CVSS score
5.4
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-10-23 15:15:32.890000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-12110",
"sourceIdentifier": "[email protected]",
"published": "2025-10-23T15:15:32.890",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are."
},
{
"lang": "es",
"value": "Se encontró una falla en Keycloak. Una sesión sin conexión sigue siendo válida cuando el alcance offline_access se elimina del cliente. El token de actualización es aceptado y se pueden seguir solicitando nuevos tokens para la sesión. Ya que puede llevar a una situación en la que un administrador elimina el alcance, y asume que las sesiones sin conexión ya no están disponibles, pero sí lo están."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Keycloak",
"product": "keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/keycloak/keycloak",
"packageName": "keycloak",
"versions": [
{
"version": "0",
"lessThan": "26.4.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2.11-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
],
"versions": [
{
"version": "26.2-12",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.2.11",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.2::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4.4-1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
],
"versions": [
{
"version": "26.4-3",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.4.4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-server",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.4::el9"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-23T14:27:24.492326Z",
"id": "CVE-2025-12110",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-613"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:21370",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:21371",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22088",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22089",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-12110",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406033",
"source": "[email protected]"
},
{
"url": "https://github.com/keycloak/keycloak/pull/43790",
"source": "[email protected]"
}
]
}