CVE-2025-11429 in KeyCloak
Summary
by MITRE • 10/23/2025
A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/28/2025
CVE-2025-11429 represents a critical session management vulnerability within the Keycloak identity and access management platform that directly impacts the security posture of organizations relying on this authentication solution. This flaw constitutes a logic error in the session handling mechanism where the system fails to properly enforce realm-level configuration changes in real-time, creating a dangerous mismatch between administrative security policies and actual session behavior. The vulnerability specifically affects how Keycloak manages the "Remember Me" functionality, which is designed to extend session lifetimes for user convenience but can become a security risk when not properly controlled.
The technical implementation of this vulnerability stems from the session expiration logic that depends on a session-local "remember-me" flag rather than validating against the current realm-level configuration settings. When administrators disable the "Remember Me" option at the realm level, existing user sessions that were created while the feature was enabled continue to operate with their extended lifetimes until natural expiration occurs. This creates a window of opportunity where security configurations are effectively bypassed for sessions that were established before the policy change, allowing attackers to potentially exploit these extended sessions for unauthorized access. The flaw directly relates to CWE-693 Protection Mechanism Failure, as the system fails to properly enforce security controls that should be applied consistently across all active sessions.
The operational impact of this vulnerability is significant as it undermines the principle of least privilege and creates persistent access vectors that can be exploited by attackers. Administrators may believe they have secured their environment by disabling "Remember Me" functionality, but the vulnerability allows existing sessions to maintain extended lifetimes, effectively neutralizing the security configuration change. This creates a scenario where an attacker who has obtained access to a valid session token can maintain long-term access to the system, potentially for months or years, until the session naturally expires. The vulnerability increases the window of opportunity for session hijacking attacks and can facilitate unauthorized access persistence, making it particularly dangerous in environments where session security is critical.
Organizations using Keycloak should implement immediate mitigations to address this vulnerability, including monitoring active sessions and manually invalidating existing sessions when realm-level security configurations change. The recommended approach involves implementing automated session validation mechanisms that force real-time enforcement of configuration changes, ensuring that any modification to realm settings immediately affects all active sessions. Additionally, administrators should consider implementing session monitoring tools that can detect and alert on anomalous session behavior, particularly when session lifetimes exceed expected parameters. This vulnerability aligns with ATT&CK technique T1563.002 for credential access and T1078.004 for valid accounts, as it enables attackers to maintain persistent access through extended session lifetimes. The flaw also demonstrates a failure in the principle of defense in depth, where multiple security controls should work together to prevent unauthorized access, but the session management logic fails to enforce the configuration change consistently across all active sessions.