Keycloak vulnerable to session takeovers due to reuse of session identifiers

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-12390 · ADVISORY
• keycloak/keycloak · WEB
• keycloak/keycloak · WEB
• keycloak/keycloak commit 5344aad · WEB
• keycloak/keycloak commit b46fab2 · WEB
• keycloak/keycloak commit d82438a · WEB
• keycloak/keycloak commit ef75a4d · WEB
• access.redhat.com/errata/RHSA-2025:21370 · WEB
• access.redhat.com/errata/RHSA-2025:21371 · WEB
• access.redhat.com/errata/RHSA-2025:22088 · WEB
• access.redhat.com/errata/RHSA-2025:22089 · WEB
• access.redhat.com/security/cve/CVE-2025-12390

org.keycloak:keycloak-services의 다른 취약점

• CVE-2026-18963심각 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme…
• CVE-2026-9800높음 8.1A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, includi…
• CVE-2026-9799보통 4.6A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one res…
• CVE-2026-9705보통 6.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT…
• CVE-2026-9086높음 7.3A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access…