{"cve":"CVE-2025-11429","nvd":{"published":"2025-10-23T14:15:35.430","modified":"2026-10-18T21:10:00.120","status":"Deferred","description":"A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the \"Remember Me\" realm setting on existing user sessions. Sessions created while \"Remember Me\" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local \"remember-me\" flag without validating the current realm-level configuration.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-613"],"references":["https://access.redhat.com/errata/RHSA-2025:22088","https://access.redhat.com/errata/RHSA-2025:22089","https://access.redhat.com/security/cve/CVE-2025-11429","https://bugzilla.redhat.com/show_bug.cgi?id=2402148","https://github.com/keycloak/keycloak/commit/a34094100716b7c69ae38eaed6678ab4344d0a1d"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-11429","score":0.00235,"percentile":0.14281,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-64w3-5q9m-68xf","url":"https://osv.dev/vulnerability/GHSA-64w3-5q9m-68xf","summary":"Keycloak does not invalidate sessions when \"Remember Me\" is disabled","modified":"2026-09-10T03:50:29.441429889Z","packages":[{"ecosystem":"Maven","name":"org.keycloak:keycloak-services","purl":"pkg:maven/org.keycloak/keycloak-services","ranges":[">=26.3.0 <26.4.1"],"fixed":["26.4.1"]},{"ecosystem":"Maven","name":"org.keycloak:keycloak-services","purl":"pkg:maven/org.keycloak/keycloak-services","ranges":["<26.2.11"],"fixed":["26.2.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}