ByteOS Network

NVD Vulnerability Details :

CVE-2025-12390

Awaiting Analysis

Source-secalert@redhat.com

Published At-28 Oct, 2025 | 14:15

Updated At-19 Dec, 2025 | 20:15

A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.0	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 6.0

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE ID	Type	Source
CWE-384	Secondary	secalert@redhat.com

CWE ID: CWE-384

Type: Secondary

Source: secalert@redhat.com

References

Hyperlink	Source	Resource
https://access.redhat.com/errata/RHSA-2025:21370	secalert@redhat.com	N/A
https://access.redhat.com/errata/RHSA-2025:21371	secalert@redhat.com	N/A
https://access.redhat.com/errata/RHSA-2025:22088	secalert@redhat.com	N/A
https://access.redhat.com/errata/RHSA-2025:22089	secalert@redhat.com	N/A
https://access.redhat.com/security/cve/CVE-2025-12390	secalert@redhat.com	N/A
https://bugzilla.redhat.com/show_bug.cgi?id=2406793	secalert@redhat.com	N/A
https://github.com/keycloak/keycloak/issues/43853	secalert@redhat.com	N/A