A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is
    removed from the client. The refresh token is accepted and you can continue to request new tokens for the
    session. As it can lead to a situation where an administrator removes the scope, and assumes that offline
    sessions are no longer available, but they are. (CVE-2025-12110)

ID	Name	Product	Family	Type	Severity
465298	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.3	Tenable Cloud Security	Echo Local Security Checks	Local	medium
465298	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.2.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
435776	SCA: security update for org.keycloak:keycloak-services (GHSA-895x-rfqp-jh5c)	Tenable Cloud Security	SCA Checks	Local	medium
435776	SCA: security update for org.keycloak:keycloak-services (GHSA-895x-rfqp-jh5c)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-12110

medium

Tenable Plugins

medium

medium

medium

medium