CVE-2025-12390

MEDIUM

Keycloak < 26.0.0 - Session Fixation via Incomplete Session Cleanup

Title source: llm
STIX 2.1

Description

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

References (7)

Core 7
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:21370
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:21371
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:22088
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:22089
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2025-12390
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2406793

Scores

CVSS v3 6.0
EPSS 0.0011
EPSS Percentile 1.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-384
Status published
Products (8)
Keycloak/keycloak < 26.0.0
org.keycloak/keycloak-services 0 - 26.0.0Maven
Red Hat/Red Hat build of Keycloak 26.2 26.2-12
Red Hat/Red Hat build of Keycloak 26.2 26.2.11-1
Red Hat/Red Hat build of Keycloak 26.2.11
Red Hat/Red Hat build of Keycloak 26.4 26.4-3
Red Hat/Red Hat build of Keycloak 26.4 26.4.4-1
Red Hat/Red Hat build of Keycloak 26.4.4
Published Oct 28, 2025
Tracked Since Feb 18, 2026