CVE-2025-12110: keycloak Insufficient Session Expiration
Vulnerability summary
CVE-2025-12110 is a medium (CVSS 5.4) Insufficient Session Expiration vulnerability in keycloak. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 23-10-2025PublishedVulnerability first disclosed.
- 20-01-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
+0.02 pp
From 0.28% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- keycloak-26.2< 26.2.5-r6 | All versions (No fix recorded)
- keycloak-26.2-iamguarded-compatAll versions (No fix recorded)
- keycloak-fips-26.2-iamguarded-fipsAll versions (No fix recorded)
Keycloak1 product
- keycloak< 26.4.3
Org.keycloak1 product
- keycloak-services< 26.2.3
3 vendors · 5 products
