Log in Start free

Vulnerability · Published Oct 23, 2025 · Assigned by redhat

CVE-2025-11429Keycloak-server: too long and not settings compliant session

Medium 5.4

In plain English

A medium-severity security flaw in keycloak from Keycloak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-services26.4.1GHSA-64w3-5q9m-68xf
Mavenorg.keycloak:keycloak-services26.2.11GHSA-64w3-5q9m-68xf

Affected products (as reported)

VendorProductVersions
Keycloak keycloak 0 – before 26.4.1
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2 see references
Red Hat Red Hat build of Keycloak 26.2.11 see references

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References