CVE-2025-11429 Keycloak-server: too long and not settings compliant session

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

com.github.vzakharchenko:radius-disconnect-plugin (1.6.1), com.github.vzakharchenko:radius-plugin (1.6.1) +65 more potentially affected by CVE-2025-11429 via org.keycloak:keycloak-services (>=26.3.0, <=26.4.0)

org.keycloak:keycloak-services MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =1.11.3, =0.7, =0.47, =0.44, =0.107, =0.41, =0.53 and more Source cves: CVE-2025-11429 Source advisory: MEND:CVE-2025-11429...

CVE-2025-11429

CVE-2025-11429 (Keycloak) is a session-management logic flaw in which sessions created with the realm’s Remember Me setting stay valid beyond a recent realm-level security change. The vulnerability stems from how Keycloak expiration logic relies on the per-session remember-me flag without validat...

CVE-2025-11429

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

CVE-2025-11429 Keycloak-server: too long and not settings compliant session

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

PT-2025-43516

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A logic flaw exists in Keycloak’s session management. The software does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created...

Red Hat Build of Keycloak 代码问题漏洞

Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. A code issue vulnerability exists in Red Hat Build of Keycloak that stems from a flaw in the session management logic that does not validate the current domain level configuration, which could lead to session...

CVE-2025-12110: Insufficient Session Expiration

A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...

CVE-2025-11429: Insufficient Session Expiration

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

PT-2025-43517

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where an offline session remains valid even after the offline access scope is removed from the client. The refresh token continues to be accepted, allowing for the...

Red Hat build of Keycloak 代码问题漏洞

Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. A code issue vulnerability exists in the Red Hat build of Keycloak, which stems from an offline session remaining active after removing the client's offlineaccess scope, which could lead to an administrator...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: cassandra, apache-nifi-registry, zookeeper, trino, cassandra-reaper, sonar-scanner-cli, thingsboard, kserve-modelmesh, management-api-for-apache-cassandra-5.0, apache-nifi, akhq, keycloak-config-cli, dependency-track, nextflow...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: cassandra, apache-nifi-registry, zookeeper, trino, cassandra-reaper, sonar-scanner-cli, thingsboard, kserve-modelmesh, management-api-for-apache-cassandra-5.0, apache-nifi, akhq, keycloak-config-cli, dependency-track, nextflow...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: nacos, trino, zookeeper, nacos-docker, kayenta-fips, hadoop-fips, knative-kafka-broker-fips, management-api-for-apache-cassandra-5.0, nextflow, ontop-fips, cassandra-reaper, kayenta, ontop, zookeeper-fips, thingsboard, knative-kafka-broker, apache-nifi-registry,...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: nacos, trino, zookeeper, nacos-docker, kayenta-fips, hadoop-fips, knative-kafka-broker-fips, management-api-for-apache-cassandra-5.0, nextflow, ontop-fips, cassandra-reaper, kayenta, ontop, zookeeper-fips, thingsboard, knative-kafka-broker, apache-nifi-registry,...

keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Security Update

New Red Hat build of Keycloak 26.2.10 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.10 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.10 and Red Hat build of Keycloak 26.2.10 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

GHSA-27GC-WJ6X-9W55 Keycloak error_description injection on error pages that can trigger phishing attacks

Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0), org.keycloak:keycloak-dependencies-server-all (24.0.2) +8 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (24.0.2)

org.keycloak:keycloak-admin-ui MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =2.5.6-24.0, =2.7.4-24.0 -...