CVE-2025-12110: Keycloak Auth Bypass Vulnerability

CVE-2025-12110 is an authentication bypass flaw in Keycloak where offline sessions remain valid after removing offline_access scope. This creates a security gap where administrators believe sessions are revoked but they persist. This post explains its impact, affected versions, and mitigation steps.

CVE-2025-12110 Overview

CVE-2025-12110 is a session management flaw in Keycloak where offline sessions remain valid after the offline_access scope is removed from a client. Refresh tokens issued before the scope removal continue to be accepted, allowing token holders to request new access tokens indefinitely. The issue creates a mismatch between administrator intent and system behavior. Administrators who revoke the offline_access scope reasonably assume that offline sessions terminate, but the sessions persist.

The weakness is categorized under CWE-613: Insufficient Session Expiration.

Critical Impact
Offline refresh tokens continue functioning after offline_access scope removal, undermining administrative controls intended to terminate long-lived session access.

Affected Products

Keycloak identity and access management server
Red Hat build of Keycloak (see Red Hat CVE Report CVE-2025-12110)
Red Hat Single Sign-On distributions covered by advisories RHSA-2025:21370, RHSA-2025:21371, RHSA-2025:22088, and RHSA-2025:22089

Discovery Timeline

2025-10-23 - CVE-2025-12110 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12110

Vulnerability Analysis

Keycloak issues offline tokens when a client requests the offline_access scope during authentication. These tokens are long-lived refresh tokens that permit clients to obtain new access tokens without user interaction. Administrators can remove the offline_access scope from a client to prevent it from creating new offline sessions.

The defect lies in how Keycloak validates existing offline sessions during token refresh operations. The server does not re-check whether the client still has the offline_access scope assigned when processing a refresh request. Previously issued refresh tokens continue to be honored, and new access tokens are minted for the offline session.

An authenticated client with a valid offline refresh token can therefore maintain persistent access to protected resources even after administrators believe the scope revocation has terminated that access path. The privilege required (PR:L) reflects that the actor must already possess a valid refresh token.

Root Cause

The root cause is missing enforcement of scope state during offline session validation. Keycloak binds the offline_access grant at token issuance but does not re-evaluate the client's current scope assignments when the refresh token is presented. See GitHub Keycloak Pull Request #43790 for the upstream fix.

Attack Vector

Exploitation requires an actor to hold a valid offline refresh token obtained before the administrator removed the offline_access scope. The actor sends a standard OAuth 2.0 refresh token request to the Keycloak /token endpoint. Keycloak returns a new access token despite the client no longer being authorized for offline access. The attack occurs over the network against the token endpoint and does not require user interaction.

The vulnerability manifests in Keycloak's token refresh flow. Refer to Red Hat Bug Report #2406033 for technical details on the session validation path.

Detection Methods for CVE-2025-12110

Indicators of Compromise

Successful refresh token exchanges from clients that no longer have the offline_access scope assigned in the Keycloak admin console
Offline sessions listed in the Keycloak admin UI for clients whose scope configuration excludes offline_access
Access token issuance events with scope=offline_access claims for clients that should not be able to request them

Detection Strategies

Audit Keycloak event logs for REFRESH_TOKEN events tied to clients where offline access has been administratively disabled
Correlate the current client scope configuration against active entries in the OFFLINE_USER_SESSION and OFFLINE_CLIENT_SESSION database tables
Baseline expected offline session counts per client and alert on outliers after scope changes

Monitoring Recommendations

Forward Keycloak event and admin event streams to a centralized log platform for retention and analysis
Alert on administrative actions that remove the offline_access scope so responders can validate that dependent sessions were revoked
Track token endpoint traffic per client and flag unexpected refresh activity following configuration changes

How to Mitigate CVE-2025-12110

Immediate Actions Required

Apply the Keycloak or Red Hat build of Keycloak update that includes the fix from Keycloak Pull Request #43790
Manually revoke existing offline sessions for any client that had its offline_access scope removed, using the Keycloak admin console or the admin REST API
Rotate client secrets and force re-authentication for high-value clients where offline access was intentionally disabled

Patch Information

Red Hat has published fixed packages via RHSA-2025:21370, RHSA-2025:21371, RHSA-2025:22088, and RHSA-2025:22089. Upstream users should upgrade to the Keycloak release incorporating the merged pull request. Consult the Red Hat CVE Report CVE-2025-12110 for version mapping.

Workarounds

Explicitly delete offline sessions through the Keycloak admin console under Sessions > Offline sessions whenever offline_access is removed from a client
Use the admin REST API endpoint POST /admin/realms/{realm}/users/{id}/logout to terminate offline sessions for affected users
Reduce the SSO Session Idle and offline session lifetime settings in the realm configuration to shorten the window during which stale offline tokens remain usable