CVE-2025-12390
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-11-28

Assigner: Red Hat, Inc.

Description
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-28
Last Modified
2025-11-28
Generated
2026-06-16
AI Q&A
2025-10-28
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12390
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak 26.4.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Keycloak allows a user to accidentally gain access to another user's session if both users use the same device and browser. The issue occurs because Keycloak sometimes reuses session identifiers and fails to properly clean up during logout when browser cookies are missing. Consequently, one user may receive authentication tokens that belong to another user.

Impact Analysis

This vulnerability can lead to unauthorized access to another user's session and sensitive information, potentially allowing one user to impersonate another. This can result in data breaches, loss of confidentiality, and unauthorized actions performed under another user's identity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart