CVE-2025-11429: Red Hat build of Keycloak 26.2 · Insufficient Session Expiration
Affects Red Hat build of Keycloak 26.2Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should immediately audit their Keycloak session management configurations and identify active sessions created under the 'Remember Me' setting. Since existing sessions retain extended lifetimes, administrators should consider forcibly terminating all active sessions or implementing a manual session invalidation process to enforce the updated realm-level settings. Monitoring and logging of session activity should be enhanced to detect unusual session durations or access patterns. Applying any forthcoming patches from Red Hat promptly is critical once available. Additionally, organizations can implement compensating controls such as multi-factor authentication (MFA) to reduce the risk of session hijacking and enforce stricter network segmentation to limit exposure. Reviewing and tightening privilege assignments to reduce the number of users who can modify session settings will also help mitigate risk. Finally, educating users about session security and encouraging regular logout practices can reduce the window of opportunity for attackers.
Description
A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.