CVE-2025-12390
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
CVE-2025-12390- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2025-36502
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
EUVD-2025-36502- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rg35-5v25-mqvp
Keycloak vulnerable to session takeovers due to reuse of session identifiers
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
GHSA-rg35-5v25-mqvp- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
CVE-2025-12390- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
CVE-2025-12390- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-rg35-5v25-mqvp
Keycloak vulnerable to session takeovers due to reuse of session identifiers
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
- Record
GHSA-rg35-5v25-mqvp- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 26.0.0 | 26.0.0 |
org.keycloak:keycloak-servicesMaven |
before 26.0.0, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
26.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12390 is a medium vulnerability (CVSS 6.0) in Keycloak, published October 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in org.keycloak:keycloak-services 26.0.0.
References
access.redhat.com/errata/RHSA-2025:21370
bugzilla.redhat.com/show_bug.cgi?id=2406793
Show 13 moreShow less
github.com/keycloak/keycloak/issues/43853
nvd.nist.gov/vuln/detail/CVE-2025-12390
catalog.redhat.com/software/containers
Left out here: 131 versions. The JSON record has them.