CVE-2025-12110 — A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new token — CVE Database · The Intelligence Room