https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:46:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266136 EUVD-2026-266136 https://cve.radiocsirt.org/vuln/euvd-2026-266136 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11429 <p>A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the &#34;Remember Me&#34; realm setting on existing user sessions. Sessions created while &#34;Remember Me&#34; was active retain their extended session lifetime until they expire, overriding the administrator&#39;s recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local &#34;remember-me&#34; flag without validating the current realm-level configuration.</p> <p>A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the &#34;Remember Me&#34; realm setting on existing user sessions. Sessions created while &#34;Remember Me&#34; was active retain their extended session lifetime until they expire, overriding the administrator&#39;s recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local &#34;remember-me&#34; flag without validating the current realm-level configuration.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11429 https://cve.radiocsirt.org/vuln/ghsa-64w3-5q9m-68xf <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the &#34;Remember Me&#34; realm setting on existing user sessions. Sessions created while &#34;Remember Me&#34; was active retain their extended session lifetime until they expire, overriding the administrator&#39;s recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local &#34;remember-me&#34; flag without validating the current realm-level configuration.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the &#34;Remember Me&#34; realm setting on existing user sessions. Sessions created while &#34;Remember Me&#34; was active retain their extended session lifetime until they expire, overriding the administrator&#39;s recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local &#34;remember-me&#34; flag without validating the current realm-level configuration.</p> https://cve.radiocsirt.org/vuln/ghsa-64w3-5q9m-68xf https://cve.radiocsirt.org/vuln/rhsa-2025:22088 <p>keycloak-server: Too long and not settings compliant session keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client&#39;s offline_access scope was removed org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass org.keycloak.protocol.oidc.endpoints.LogoutEndpoint: Offline Session takeover due to reused Authentication Session ID org.keycloak.storage.ldap: Keycloak: Deserialization of Untrusted Data in LDAP User Federation</p> <p>keycloak-server: Too long and not settings compliant session keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client&#39;s offline_access scope was removed org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass org.keycloak.protocol.oidc.endpoints.LogoutEndpoint: Offline Session takeover due to reused Authentication Session ID org.keycloak.storage.ldap: Keycloak: Deserialization of Untrusted Data in LDAP User Federation</p> https://cve.radiocsirt.org/vuln/rhsa-2025:22088 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2224 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um einen Denial of Service Angriff durchzuführen und Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um einen Denial of Service Angriff durchzuführen und Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2224