CVE-2025-11429: Keycloak Services Session Management Logic Flaw
Summary
CVE-2025-11429: Keycloak does not invalidate sessions when "Remember Me" is disabled. Affects org.keycloak:keycloak-services versions < 26.4.1. Fixed in 26.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on, user federation, identity brokering, and social login. The package 'org.keycloak:keycloak-services' is pivotal in managing user sessions and security configurations. However, it has a vulnerability that affects its session management capabilities, specifically related to the 'Remember Me' functionality.
Vulnerability Detail
A flaw was found in Keycloak where the system does not immediately enforce the disabling of the 'Remember Me' realm setting on existing user sessions. This means that sessions created while 'Remember Me' was active retain their extended session lifetime until they expire, even after an administrator has disabled this feature. This logic flaw in session management increases the risk of session hijacking or unauthorized long-term access persistence, as it relies on the session-local 'remember-me' flag without validating the current realm-level configuration.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually invalidate existing user sessions that were created while 'Remember Me' was enabled. This can be done through the Keycloak admin console by navigating to the 'Sessions' section and terminating the affected sessions.
Conclusion
The CVE-2025-11429 vulnerability in Keycloak's session management poses a risk of unauthorized access due to a flaw in enforcing security settings. It is crucial for administrators to update to the patched version and consider session invalidation as a temporary measure to protect user data.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The vulnerability allows existing sessions to bypass recent security settings, potentially leading to unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just the pom.xml file. Visit Vulert Scanner to check your application without signup.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Yes, the vulnerability is fixed in version 26.4.1 of the 'org.keycloak:keycloak-services' package.
If an immediate update is not possible, consider invalidating existing sessions to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
