Keycloak CVE-2025-12110

Exploitation requires the attacker to already hold a valid offline refresh token issued while the client had the offline_access scope granted (TOKEN_TYPE_OFFLINE), and is only meaningful after an administrator removes the offline_access scope from that client expecting sessions to be revoked. It is therefore not remote-unauthenticated: the limiting factors are prior legitimate acquisition of an offline token (PR:L), a specific administrative scope-removal action as the triggering event, and the fact that the window is bounded by the offline session's normal lifetime/idle timeout. No special network configuration is needed, but the flaw cannot be triggered against a client that never issued offline tokens.

This is a medium-severity (CVSS 5.4) session management flaw (CWE-613, Insufficient Session Expiration) in Keycloak, and the signals consistently point to a low-urgency, defense-in-depth issue rather than an active priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation but requires existing low-level privilege (PR:L) - the actor must already be a legitimate user who previously obtained an offline refresh token. EPSS is low at 0.30% (21st percentile), there is no CISA KEV listing, and no public exploit has been identified, so there is no evidence of weaponization. The signals do not conflict: a low EPSS, absence of KEV, and a modest CVSS with partial C/I impact all align on a scenario of lingering valid sessions rather than remote code execution or privilege escalation. The real risk is operational/governance: an administrator who removes the offline_access scope reasonably assumes offline sessions are revoked, but they persist - meaning deprovisioning and access-revocation workflows silently fail. The input Tag 'Information Disclosure' understates the nature of the flaw, which is really unexpected session persistence; treat the tag as approximate.

A user (or compromised account) obtains an offline refresh token from a client configured with the offline_access scope. An administrator later removes the offline_access scope from that client, believing all offline sessions are now invalidated, but the previously issued refresh token continues to be accepted and can be exchanged for fresh access tokens indefinitely. No public exploit code or active exploitation has been reported; exploitation simply requires retaining a token issued before the scope change.