CVE-2025-12390 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happe…
Medium CVSS: 6.0

CVE-2025-12390

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
Vendor
-
Product
-
CWE
CWE-384
Yayın Tarihi
2025-10-28 14:15:57
Güncelleme
2025-12-19 20:15:49
Source Identifier
secalert@redhat.com
KEV Date Added
-

Kategoriler

CWE-384 MEDIUM 2025

Referanslar

https://access.redhat.com/errata/RHSA-2025:21370 https://access.redhat.com/errata/RHSA-2025:21371 https://access.redhat.com/errata/RHSA-2025:22088 https://access.redhat.com/errata/RHSA-2025:22089 https://access.redhat.com/security/cve/CVE-2025-12390 https://bugzilla.redhat.com/show_bug.cgi?id=2406793 https://github.com/keycloak/keycloak/issues/43853