Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-64w3-5q9m-68xf
Advisory ID github_osv/GHSA-64w3-5q9m-68xf
Aliases CVE-2025-11429
Summary Keycloak does not invalidate sessions when "Remember Me" is disabled A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
Status Published
Exploitability 0.5
Weighted Severity 4.9
Risk 2.5
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-613 Insufficient Session Expiration
System Score Found at
cvssv3.1 5.4 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json
generic_textual MODERATE
Reference id Reference type URL
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/a752492843e21c3ab06090616692e53001864158
43328 Other https://github.com/keycloak/keycloak/issues/43328
a34094100716b7c69ae38eaed6678ab4344d0a1d Other https://github.com/keycloak/keycloak/commit/a34094100716b7c69ae38eaed6678ab4344d0a1d
bda0e2a67c8cf41d1b3d9010e6dfcddaf79bf59b Other https://github.com/keycloak/keycloak/commit/bda0e2a67c8cf41d1b3d9010e6dfcddaf79bf59b
CVE-2025-11429 Advisory https://access.redhat.com/security/cve/CVE-2025-11429
CVE-2025-11429 https://nvd.nist.gov/vuln/detail/CVE-2025-11429
RHSA-2025:22088 Advisory https://access.redhat.com/errata/RHSA-2025:22088
RHSA-2025:22089 Advisory https://access.redhat.com/errata/RHSA-2025:22089
show_bug.cgi?id=2402148 Bug https://bugzilla.redhat.com/show_bug.cgi?id=2402148
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-64w3-5q9m-68xf/GHSA-64w3-5q9m-68xf.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:31:09Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/11xxx/CVE-2025-11429.json

Source Advisory: vulnrichment/CVE-2025-11429

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]