CVE-2025-12110: Keycloak

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

Affected products

• Keycloak Keycloak: before 26.4.3 (fixed in 26.4.3)
• Red Hat Red Hat Build Of Keycloak 26.2: before 26.2.11-1 (fixed in 26.2.11-1); before 26.2-12 (fixed in 26.2-12)
• Red Hat Red Hat Build Of Keycloak 26.2.11
• Red Hat Red Hat Build Of Keycloak 26.4: before 26.4.4-1 (fixed in 26.4.4-1); before 26.4-3 (fixed in 26.4-3)
• Red Hat Red Hat Build Of Keycloak 26.4.4

Published 2025-10-23. Last modified 2026-06-17.