{"action":"Upgrade org.keycloak:keycloak-services to 26.0.0 or later.","affected":[{"fixed":"26.0.0","introduced":"0"}],"component":"org.keycloak:keycloak-services","cve_ids":["CVE-2025-12390"],"ecosystem":"Maven","epss":0.00141,"exploited":false,"fixed_versions":["26.0.0"],"ghsa_id":"GHSA-rg35-5v25-mqvp","id":"tcs_01M5N9BRTEZG8P7M04SWFY8VWV","modified_at":"2026-09-10T03:50:58.286948756Z","published_at":"2025-10-28T15:30:43Z","references":["https://osv.dev/vulnerability/GHSA-rg35-5v25-mqvp","https://nvd.nist.gov/vuln/detail/CVE-2025-12390","https://github.com/keycloak/keycloak/issues/32197","https://github.com/keycloak/keycloak/issues/43853","https://github.com/keycloak/keycloak/commit/5344aada5ee06b02ec3a9e0f52fa381d085b6282","https://github.com/keycloak/keycloak/commit/b46fab230824a2304daafe74be019e8bd4ee590a","https://github.com/keycloak/keycloak/commit/d82438a611f2f869f1966c13012953fe963a493d","https://github.com/keycloak/keycloak/commit/ef75a4dc50aa9459777494e4b88655100bf2ac80","https://access.redhat.com/errata/RHSA-2025:21370","https://access.redhat.com/errata/RHSA-2025:21371","https://access.redhat.com/errata/RHSA-2025:22088","https://access.redhat.com/errata/RHSA-2025:22089","https://access.redhat.com/security/cve/CVE-2025-12390","https://bugzilla.redhat.com/show_bug.cgi?id=2406793","https://github.com/keycloak/keycloak","https://github.com/keycloak/keycloak/discussions/31265"],"severity":{"label":"medium","score":6},"sources":[{"source":"osv","source_id":"GHSA-rg35-5v25-mqvp","url":"https://osv.dev/vulnerability/GHSA-rg35-5v25-mqvp"}],"summary":"Keycloak vulnerable to session takeovers due to reuse of session identifiers"}