CVE-2025-12390
BaseFortify
Publication date: 2025-10-28
Last updated on: 2025-11-28
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | keycloak | 26.4.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-384 | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Keycloak allows a user to accidentally gain access to another user's session if both users use the same device and browser. The issue occurs because Keycloak sometimes reuses session identifiers and fails to properly clean up during logout when browser cookies are missing. Consequently, one user may receive authentication tokens that belong to another user.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to another user's session and sensitive information, potentially allowing one user to impersonate another. This can result in data breaches, loss of confidentiality, and unauthorized actions performed under another user's identity.