de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta1), org.keycloak:keycloak-model-jpa (4.0.0.beta1) +2 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (4.0.0.beta1)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta1 - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.3), com.github.vzakharchenko:cisco-radius-plugin (1.3.3) +23 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (12.0.2)

org.keycloak:keycloak-services MAVEN version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.3 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

org.keycloak:keycloak-authz-policy-drools (2.1.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.1.0.cr1) +3 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (2.1.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.1.0.cr1 -...

org.keycloak:keycloak-account-freemarker (1.1.1.final), org.keycloak:keycloak-dependencies-server-min (1.1.1.final) +1 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (1.1.1.final)

org.keycloak:keycloak-services MAVEN version 1.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.1.final -...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-dependencies-server-min (10.0.0) +5 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (10.0.0)

org.keycloak:keycloak-services MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 - org.keycloak:keycloak-dependencies-server-m...

de.adorsys.sts:keycloak-storage-provider (>=1.2.0, <=1.2.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (>=6.5, <=6.9) +23 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (25.0.2)

org.keycloak:keycloak-services MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.2.0, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5,...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=3.0.1-25.0, <=4.0.1-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.1-25.0) +25 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (25.0.1)

org.keycloak:keycloak-services MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =3.0.1-25.0, =3.0.1-25.0, =4.0.1-25.0 -...

GHSA-895X-RFQP-JH5C Keycloak does not invalidate offline sessions when the offline_access scope is removed

A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...

Insufficient Session Expiration

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the offline session of a user not being invalidated when the...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.6), com.github.vzakharchenko:cisco-radius-plugin (1.4.6) +31 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (18.0.2)

org.keycloak:keycloak-services MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.6 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-account-freemarker (1.0-beta-4) +3 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (1.0-beta-4)

org.keycloak:keycloak-services MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.keycloak:keycloak-dependencies-server-all (1.9.0.final), org.keycloak:keycloak-dependencies-server-min (1.9.0.final) +2 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (1.9.0.final)

org.keycloak:keycloak-services MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.0.final -...

org.keycloak:keycloak-dependencies-server-all (11.0.1), org.keycloak:keycloak-dependencies-server-min (11.0.1) +6 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (11.0.1)

org.keycloak:keycloak-services MAVEN version 11.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.1 - org.keycloak:keycloak-dependencies-server-m...

org.keycloak:keycloak-authz-policy-drools (2.1.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.1.0.cr1) +3 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (2.1.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.1.0.cr1 -...

io.github.johnjcool:keycloak-cas-services (4.8.3.final), it.vige:school-keycloak-rooms (>=1.2.2, <=1.3.0) +4 more potentially affected by CVE-2025-12110 via org.keycloak:keycloak-services (4.8.3.final)

org.keycloak:keycloak-services MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.8.3.final - it.vige:school-keycloak-rooms =1.2.2,...