Keycloak CVE-2025-11429

Exploitation requires a specific prior state: the realm had 'Remember Me' enabled, a user logged in with the Remember Me checkbox selected (creating a session with the session-local remember-me flag), and the administrator subsequently disabled the realm-level Remember Me setting. The attacker must possess or control that still-valid session cookie or its associated refresh token before natural expiry. Limiting factors: PR:L means a valid pre-existing session is needed (not anonymous remote access), the window is bounded by the original extended session lifetime, and the condition only arises after an administrator changes the Remember Me setting - default or never-enabled realms are unaffected. Fixed in Keycloak 26.4.1, which invalidates such sessions when the token/cookie is next used.

This is a genuine but low-to-moderate priority session management weakness (CWE-613, Insufficient Session Expiration), not a high-impact emergency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network reachability but only limited confidentiality and integrity impact and no availability impact, with PR:L indicating some level of valid session/credential is needed - consistent with the flaw being about persistence of an already-authenticated session rather than fresh unauthorized access. All exploitation signals point the same (low) direction: EPSS is 0.24% (13th percentile), there is no CISA KEV listing, and no public exploit code was identified - so there is no evidence of active or widespread exploitation. The one point of friction is the input Tag 'Authentication Bypass', which overstates the issue: this is not a credential or authentication bypass but a failure to re-validate an existing session's remember-me flag against current realm configuration, so defenders should treat it as a session-lifetime/hygiene issue. No SSVC decision data was supplied in the input, so automatable/technical-impact framing could not be cross-referenced. Net assessment: a real logic bug worth patching in the normal cycle, but not a drop-everything priority.

An administrator, reacting to a security concern, disables the realm's 'Remember Me' setting expecting existing long-lived sessions to be terminated. However, a user session (or a stolen session cookie/refresh token) created earlier with the Remember Me flag remains valid for its full extended lifetime, so an attacker holding that session token retains access well past when the policy change should have cut it off. No public exploit code exists; exploitation requires possession of a still-valid pre-existing remember-me session.