Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed (Keycloak keycloak)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.
Weaknesses (CWE)
- CWE-613 — DEPRECATED: Insufficient Session Expiration
References
- https://access.redhat.com/errata/RHSA-2025:21370
- https://access.redhat.com/errata/RHSA-2025:21371
- https://access.redhat.com/errata/RHSA-2025:22088
- https://access.redhat.com/errata/RHSA-2025:22089
- https://access.redhat.com/security/cve/CVE-2025-12110
- https://bugzilla.redhat.com/show_bug.cgi?id=2406033
- https://github.com/keycloak/keycloak/pull/43790
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
| CVSS 3.1 | MEDIUM 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-895x-rfqp-jh5c — Keycloak does not invalidate offline sessions when the offline_access scope is removed
European references
- ENISA EUVD · EUVD-2025-35690
- GCVE · GCVE-0-2025-12110
Affected products
| Product | Versions |
|---|---|
| Keycloak · keycloak | affected 0 < 26.4.3 |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2.11-1 < * |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2-12 < * |
| Red Hat · Red Hat build of Keycloak 26.2 | unaffected 26.2-12 < * |
| Red Hat · Red Hat build of Keycloak 26.2.11 | |
| Red Hat · Red Hat build of Keycloak 26.4 | unaffected 26.4.4-1 < * |
| Red Hat · Red Hat build of Keycloak 26.4 | unaffected 26.4-3 < * |
| Red Hat · Red Hat build of Keycloak 26.4 | unaffected 26.4-3 < * |
| Red Hat · Red Hat build of Keycloak 26.4.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |