CVE-2025-12110
Fixed in a distro release EPSS <1%CVSS 5.4
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Products: keycloak, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2.11, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 26.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak-26.2 | 26.2.5-r6 |
| Chainguard | keycloak-26.2 | no fix |
| Chainguard | keycloak-26.2-iamguarded-compat | no fix |
| Chainguard | keycloak-fips-26.2-iamguarded-fips | no fix |