CVE-2025-11429

MEDIUM5.4EPSS 0.13%

Keycloak does not invalidate sessions when "Remember Me" is disabled

發布日:2025/10/23修改日:2026/2/17
也稱為:GHSA-64w3-5q9m-68xfCGA-q7q8-2r2r-r8q5

描述

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

參考連結(10)