EUVD-2025-35689

Keycloak does not invalidate sessions when "Remember Me" is disabled...

CVE-2025-11429 Keycloak-server: too long and not settings compliant session

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security...

CVE-2025-59451: Incorrect Authorization

The YoSmart YoLink application through 2025-10-02 has session tokens with unexpectedly long lifetimes...