Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5zh4-963a-q3gp
Vulnerability ID VCID-5zh4-963a-q3gp
Aliases CVE-2025-12390
GHSA-rg35-5v25-mqvp
Summary Keycloak vulnerable to session takeovers due to reuse of session identifiers A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-384 Session Fixation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6 https://access.redhat.com/errata/RHSA-2025:21370
cvssv3.1 6.0 https://access.redhat.com/errata/RHSA-2025:21370
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:21370
ssvc Track https://access.redhat.com/errata/RHSA-2025:21370
cvssv3.1 6 https://access.redhat.com/errata/RHSA-2025:21371
cvssv3.1 6.0 https://access.redhat.com/errata/RHSA-2025:21371
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:21371
ssvc Track https://access.redhat.com/errata/RHSA-2025:21371
cvssv3.1 6 https://access.redhat.com/errata/RHSA-2025:22088
cvssv3.1 6.0 https://access.redhat.com/errata/RHSA-2025:22088
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:22088
ssvc Track https://access.redhat.com/errata/RHSA-2025:22088
cvssv3.1 6 https://access.redhat.com/errata/RHSA-2025:22089
cvssv3.1 6.0 https://access.redhat.com/errata/RHSA-2025:22089
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:22089
ssvc Track https://access.redhat.com/errata/RHSA-2025:22089
cvssv3 6.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12390.json
cvssv3.1 6 https://access.redhat.com/security/cve/CVE-2025-12390
cvssv3.1 6.0 https://access.redhat.com/security/cve/CVE-2025-12390
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-12390
ssvc Track https://access.redhat.com/security/cve/CVE-2025-12390
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00011 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-12390
cvssv3.1 6 https://bugzilla.redhat.com/show_bug.cgi?id=2406793
cvssv3.1 6.0 https://bugzilla.redhat.com/show_bug.cgi?id=2406793
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2406793
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2406793
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rg35-5v25-mqvp
cvssv3.1 6.0 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 6.0 https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282
cvssv3.1 6.0 https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a
cvssv3.1 6.0 https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d
cvssv3.1 6.0 https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80
cvssv3.1 6.0 https://github.com/keycloak/keycloak/discussions/31265
generic_textual MODERATE https://github.com/keycloak/keycloak/discussions/31265
cvssv3.1 6.0 https://github.com/keycloak/keycloak/issues/32197
generic_textual MODERATE https://github.com/keycloak/keycloak/issues/32197
cvssv3.1 6 https://github.com/keycloak/keycloak/issues/43853
cvssv3.1 6.0 https://github.com/keycloak/keycloak/issues/43853
generic_textual MODERATE https://github.com/keycloak/keycloak/issues/43853
ssvc Track https://github.com/keycloak/keycloak/issues/43853
cvssv3.1 6.0 https://nvd.nist.gov/vuln/detail/CVE-2025-12390
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-12390
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:21370
https://access.redhat.com/errata/RHSA-2025:21371
https://access.redhat.com/errata/RHSA-2025:22088
https://access.redhat.com/errata/RHSA-2025:22089
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12390.json
https://api.first.org/data/v1/epss?cve=CVE-2025-12390
https://bugzilla.redhat.com/show_bug.cgi?id=2406793
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282
https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a
https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d
https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80
https://github.com/keycloak/keycloak/discussions/31265
https://github.com/keycloak/keycloak/issues/32197
https://github.com/keycloak/keycloak/issues/43853
cpe:/a:redhat:build_keycloak:26.2::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.2::el9
cpe:/a:redhat:build_keycloak:26.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.4::el9
CVE-2025-12390 https://access.redhat.com/security/cve/CVE-2025-12390
CVE-2025-12390 https://nvd.nist.gov/vuln/detail/CVE-2025-12390
GHSA-rg35-5v25-mqvp https://github.com/advisories/GHSA-rg35-5v25-mqvp
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:21370
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:21370
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://access.redhat.com/errata/RHSA-2025:21370
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:21371
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:21371
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://access.redhat.com/errata/RHSA-2025:21371
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:22088
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:22088
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://access.redhat.com/errata/RHSA-2025:22088
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:22089
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:22089
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://access.redhat.com/errata/RHSA-2025:22089
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12390.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-12390
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-12390
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://access.redhat.com/security/cve/CVE-2025-12390
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2406793
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2406793
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2406793
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/discussions/31265
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/issues/32197
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/issues/43853
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak/issues/43853
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-10-28T13:45:05Z/ Found at https://github.com/keycloak/keycloak/issues/43853
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-12390
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.01345
EPSS Score 0.00011
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:53:04.539472+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.keycloak/keycloak-services/CVE-2025-12390.yml 38.0.0