CVE-2025-11429
Medium · 5.4CVSS
5.4
EPSS
0.2%
Published
Oct 23, 2025
CISA due date
—
The record
A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | 0 | 26.2.11 |
| Maven | org.keycloak:keycloak-services | 0 | 26.4.1 |
| Maven | org.keycloak:keycloak-services | 26.3.0 | 26.4.1 |
| Chainguard | keycloak-26.2-compat | 0 | 26.2.5-r6 |
| Chainguard | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Chainguard | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r7 |
| Chainguard | keycloak-26.4 | 0 | 26.4.2-r0 |
| Chainguard | keycloak-26.4-compat | 0 | 26.4.2-r0 |
| Chainguard | keycloak-26.4-iamguarded-compat | 0 | 26.4.2-r0 |
| Chainguard | keycloak-26.4-operator | 0 | 26.4.2-r0 |
| Chainguard | keycloak-26.4-operator-compat | 0 | 26.4.2-r0 |
| Chainguard | keycloak-fips-26.3-operator | 0 | 26.3.5-r4 |
| Chainguard | keycloak-fips-26.3-operator-compat | 0 | 26.3.5-r4 |
| Wolfi | keycloak-26.3-compat | 0 | 26.3.5-r3 |
| Wolfi | keycloak-26.3-iamguarded-compat | 0 | 26.3.5-r7 |
| Wolfi | keycloak-26.4 | 0 | 26.4.2-r0 |
| Wolfi | keycloak-26.4-compat | 0 | 26.4.2-r0 |
| Wolfi | keycloak-26.4-iamguarded-compat | 0 | 26.4.2-r0 |
| Wolfi | keycloak-26.4-operator | 0 | 26.4.2-r0 |
| Wolfi | keycloak-26.4-operator-compat | 0 | 26.4.2-r0 |
Related vulnerabilities
- GHSA-7g5x-9c4v-4w5r Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass Also affects org.keycloak:keycloak-services
- CVE-2025-12150 A flaw was found in Keycloak’s WebAuthn registration component. Also affects org.keycloak:keycloak-services
- GHSA-fjf4-6f34-w64q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol Also affects org.keycloak:keycloak-services
- CVE-2026-2733 A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens… Also affects org.keycloak:keycloak-services
- GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens Also affects org.keycloak:keycloak-services
- GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation Also affects org.keycloak:keycloak-services
- GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the… Also affects org.keycloak:keycloak-services
- CVE-2026-1486 A flaw was found in Keycloak. Also affects org.keycloak:keycloak-services