CVE-2025-12110

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
Keycloak	keycloak	< 26.4.3
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat build of Keycloak 26.2	—
Red Hat	Red Hat build of Keycloak 26.2.11	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4.4	—

References

Timeline

Published: Oct 23, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-121126.4The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all CVE-2025-121134.3The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data CVE-2025-121145.5Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: throu CVE-2025-121157.5The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and inclu CVE-2025-121166.4The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 du CVE-2025-121176.4The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.1 d CVE-2025-121186.4The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including CVE-2025-121193.3A mongoc_bulk_operation_t may read invalid memory if large options are passed.CVE-2025-12127.5An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prio CVE-2025-121207.3Lite XL versions 2.1.8 and prior automatically execute the .lite_project.lua file when opening a project directory, without prompting the us CVE-2025-121217.3Lite XL versions 2.1.8 and prior contain a vulnerability in the system.exec function, which allowed arbitrary command execution through unsa CVE-2025-121226.4The Popup Box – Easily Create WordPress Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox