Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-uuf2-u7xh-uuef
Vulnerability ID VCID-uuf2-u7xh-uuef
Aliases CVE-2025-12110
GHSA-895x-rfqp-jh5c
Summary Keycloak does not invalidate offline sessions when the offline_access scope is removed A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-613 Insufficient Session Expiration
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:21370
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:21370
ssvc Track https://access.redhat.com/errata/RHSA-2025:21370
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:21371
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:21371
ssvc Track https://access.redhat.com/errata/RHSA-2025:21371
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:22088
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:22088
ssvc Track https://access.redhat.com/errata/RHSA-2025:22088
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2025:22089
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:22089
ssvc Track https://access.redhat.com/errata/RHSA-2025:22089
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12110.json
cvssv3.1 5.4 https://access.redhat.com/security/cve/CVE-2025-12110
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-12110
ssvc Track https://access.redhat.com/security/cve/CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
epss 0.00056 https://api.first.org/data/v1/epss?cve=CVE-2025-12110
cvssv3.1 5.4 https://bugzilla.redhat.com/show_bug.cgi?id=2406033
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2406033
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2406033
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-895x-rfqp-jh5c
cvssv3.1 5.4 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 5.4 https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
cvssv3.1 5.4 https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
cvssv3.1 5.4 https://github.com/keycloak/keycloak/pull/43790
generic_textual MODERATE https://github.com/keycloak/keycloak/pull/43790
ssvc Track https://github.com/keycloak/keycloak/pull/43790
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2025-12110
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-12110
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2025:21370
https://access.redhat.com/errata/RHSA-2025:21371
https://access.redhat.com/errata/RHSA-2025:22088
https://access.redhat.com/errata/RHSA-2025:22089
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12110.json
https://api.first.org/data/v1/epss?cve=CVE-2025-12110
https://bugzilla.redhat.com/show_bug.cgi?id=2406033
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
https://github.com/keycloak/keycloak/pull/43790
cpe:/a:redhat:build_keycloak:26.2::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.2::el9
cpe:/a:redhat:build_keycloak:26.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:26.4::el9
CVE-2025-12110 https://access.redhat.com/security/cve/CVE-2025-12110
CVE-2025-12110 https://nvd.nist.gov/vuln/detail/CVE-2025-12110
GHSA-895x-rfqp-jh5c https://github.com/advisories/GHSA-895x-rfqp-jh5c
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:21370
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://access.redhat.com/errata/RHSA-2025:21370
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:21371
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://access.redhat.com/errata/RHSA-2025:21371
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:22088
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://access.redhat.com/errata/RHSA-2025:22088
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2025:22089
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://access.redhat.com/errata/RHSA-2025:22089
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-12110.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2025-12110
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://access.redhat.com/security/cve/CVE-2025-12110
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2406033
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2406033
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/pull/43790
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:27:24Z/ Found at https://github.com/keycloak/keycloak/pull/43790
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-12110
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17639
EPSS Score 0.00056
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:53:03.260328+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.keycloak/keycloak-services/CVE-2025-12110.yml 38.0.0