CVE-2025-12390 MEDIUM

CVE-2025-12390: Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

Vendor Keycloak
Product keycloak
Weakness CWE-384 · Session fixation
Published October 28, 2025
Last update January 6, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

Key dates

02Disclosure timeline

October 28, 2025 CVE published
January 6, 2026 Record updated