CVE-2025-12110: Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-23 · updated 2026-10-18
Weakness: CWE-613

Description

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 26.2-12, 26.2.11-1, 26.4-3, 26.4.4-1
Keycloak: before 26.4.3 — fixed in 26.4.3

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 26.2-12, 26.2.11-1, 26.4-3, 26.4.4-1; Keycloak 26.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-12110 or the next vulnerability affects your stack