CVE-2025-11429: Keycloak does not invalidate sessions when "Remember Me" is disabled

The vulnerability described is a logic flaw in Keycloak's session management, where disabling the "Remember Me" feature does not invalidate existing sessions that were created with it. This allows those sessions to persist longer than the administrator intended, increasing the risk of session hijacking.

The analysis of the provided patches, specifically commits a34094100716b7c69ae38eaed6678ab4344d0a1d and bda0e2a67c8cf41d1b3d9010e6dfcddaf79bf59b, points directly to the isSessionValid method in the AuthenticationManager.java file. The patch introduces a new check in this method:

+        if (userSession.isRememberMe() && !realm.isRememberMe()) {
+            logger.debugv("Session {0} invalid: created with remember me but remember me is disabled for the realm.", userSession.getId());
+            return false;
+        }

This code explicitly checks if a user session has the rememberMe flag set while the realm has since disabled the rememberMe feature. If this condition is met, the session is now correctly identified as invalid.

Therefore, any operation that triggers a session validation check, such as a token refresh or accessing a protected resource, would invoke the isSessionValid function. Before the patch, this function would have incorrectly returned true for a "Remember Me" session even after the feature was disabled, thus making it the vulnerable function. The added code constitutes the fix.