CVE-2025-12390
1 advisory.
Maven/org.keycloak:keycloak-services CVE-2025-12390: medium 6
Keycloak vulnerable to session takeovers due to reuse of session identifiers
Action: Upgrade org.keycloak:keycloak-services to 26.0.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 26.0.0 | - |
Fixed versions
| 26.0.0 |
Sources
- osv: GHSA-rg35-5v25-mqvp
- https://nvd.nist.gov/vuln/detail/CVE-2025-12390
- https://github.com/keycloak/keycloak/issues/32197
- https://github.com/keycloak/keycloak/issues/43853
- https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282
- https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a
- https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d
- https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80
- https://access.redhat.com/errata/RHSA-2025:21370
- https://access.redhat.com/errata/RHSA-2025:21371
- https://access.redhat.com/errata/RHSA-2025:22088
- https://access.redhat.com/errata/RHSA-2025:22089
- https://access.redhat.com/security/cve/CVE-2025-12390
- https://bugzilla.redhat.com/show_bug.cgi?id=2406793
- https://github.com/keycloak/keycloak
- https://github.com/keycloak/keycloak/discussions/31265
CVE-2025-12390 · published · modified · JSON