CVE-2025-12390: Keycloak Services Vulnerable to Session Takeovers Due to Session Identifier Reuse
Summary
CVE-2025-12390: Keycloak vulnerable to session takeovers due to reuse of session identifiers. Affects org.keycloak:keycloak-services versions < 26.4.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. Keycloak's services are widely used in enterprise environments to manage user authentication and authorization. However, a vulnerability has been identified that allows session identifiers to be reused, potentially leading to unauthorized access to user sessions.
Vulnerability Detail
A flaw was found in Keycloak where a user can accidentally gain access to another user's session if both users utilize the same device and browser. This issue arises because Keycloak sometimes reuses session identifiers and fails to properly clean up during logout when browser cookies are missing. Consequently, one user may receive tokens that belong to another user, leading to session takeovers and unauthorized access to sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to clear their browser cookies and cache after logging out of Keycloak. This can help prevent session identifiers from being reused inadvertently. Additionally, using different browsers or incognito mode for different users can mitigate the risk of session takeovers.
Conclusion
The vulnerability identified in Keycloak (CVE-2025-12390) poses a risk of session takeovers due to the reuse of session identifiers. It is crucial for users to update to the patched version of the package to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
The CVSS score of this vulnerability is 6.0, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to user sessions, which can lead to data breaches and exposure of sensitive information.
Yes, a patch is available in version 26.4.3 of the Keycloak services package. It is recommended to update to this version.
If you cannot update the package immediately, consider implementing the suggested workarounds, such as clearing browser cookies and using different browsers for different users.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
