CVE-2025-12110: Keycloak does not invalidate offline sessions when the offline_access scope is removed
(updated )
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
References
- access.redhat.com/errata/RHSA-2025:21370
- access.redhat.com/errata/RHSA-2025:21371
- access.redhat.com/errata/RHSA-2025:22088
- access.redhat.com/errata/RHSA-2025:22089
- access.redhat.com/security/cve/CVE-2025-12110
- bugzilla.redhat.com/show_bug.cgi?id=2406033
- github.com/advisories/GHSA-895x-rfqp-jh5c
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/commit/54e1c8af1e089ad33d32e0f2792610e4b8df421b
- github.com/keycloak/keycloak/commit/c830a27928cac4294619af7d147bdff34d4a85e7
- github.com/keycloak/keycloak/pull/43790
- nvd.nist.gov/vuln/detail/CVE-2025-12110
Code Behaviors & Features
Detect and mitigate CVE-2025-12110 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →