Keycloak does not invalidate sessions when "Remember Me" is disabled

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

CVE-2025-11429

CVE-2025-11429 (Keycloak) is a session-management logic flaw in which sessions created with the realm’s Remember Me setting stay valid beyond a recent realm-level security change. The vulnerability stems from how Keycloak expiration logic relies on the per-session remember-me flag without validat...