Vulnerabilities CVE-2025-12390

CVE-2025-12390

Medium

Open

TLP:CLEAR

Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

Details

CVSS Score: 6.0
EPSS Score ⓘ: 0.13%

3.1th percentile
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Confidence: 90%
Published: Oct 28, 2025
Last Modified: Jul 30, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.