Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-12110

Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Keycloak keycloak

Default version status: unaffected

  • 0 to < 26.4.3affected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2.11-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2

Default version status: affected

  • 26.2-12 to < *unaffected

Red Hat Red Hat build of Keycloak 26.2.11

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4.4-1 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-3 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4

Default version status: affected

  • 26.4-3 to < *unaffected

Red Hat Red Hat build of Keycloak 26.4.4

Default version status: unaffected

References