A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's
    session if both use the same device and browser. This happens because Keycloak sometimes reuses session
    identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one
    user may receive tokens that belong to another user. (CVE-2025-12390)

ID	Name	Product	Family	Type	Severity
461594	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461594	Echo: keycloak-25: security update to 25.0.6+e1org.keycloak:keycloak-services: security update to 26.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
436025	SCA: security update for org.keycloak:keycloak-services (GHSA-rg35-5v25-mqvp)	Tenable Cloud Security	SCA Checks	Local	medium
436025	SCA: security update for org.keycloak:keycloak-services (GHSA-rg35-5v25-mqvp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-12390

medium

Tenable Plugins

medium

medium

medium

medium