VersionDrift
Product

Keycloak

Identity · products/keycloak.yaml · RSS

Latest 26.8.1 Oct 13, 2026

Lifecycle

BranchLatestReleasedEnd of life
26.826.8.1Oct 1, 2026— · maintained
26.726.7.5Jul 9, 2026Oct 1, 2026 · ended
26.626.6.4Apr 8, 2026Jul 9, 2026 · ended
26.526.5.7Jan 6, 2026Apr 8, 2026 · ended
26.426.4.7Sep 30, 2025Jan 6, 2026 · ended
26.326.3.5Jul 2, 2025Sep 30, 2025 · ended
26.226.2.5Apr 11, 2025Jul 2, 2025 · ended
26.126.1.5Jan 15, 2025Apr 11, 2025 · ended
26.026.0.8Oct 4, 2024Jan 15, 2025 · ended
25.025.0.6Jun 10, 2024Oct 4, 2024 · ended
24.024.0.5Mar 4, 2024Jun 10, 2024 · ended
23.023.0.7Nov 23, 2023Mar 4, 2024 · ended
22.022.0.5Jul 11, 2023Nov 23, 2023 · ended
21.121.1.2Apr 19, 2023Jul 11, 2023 · ended
21.021.0.2Feb 23, 2023Apr 19, 2023 · ended
20.020.0.5Nov 1, 2022Feb 23, 2023 · ended
19.019.0.3Jul 27, 2022Nov 1, 2022 · ended
18.018.0.2Apr 20, 2022Jul 27, 2022 · ended
17.017.0.1Feb 11, 2022Apr 20, 2022 · ended
16.116.1.1Dec 20, 2021Mar 11, 2022 · ended
16.016.0.0Dec 17, 2021Dec 20, 2021 · ended
15.115.1.1Dec 10, 2021Dec 17, 2021 · ended
15.015.0.2Jul 30, 2021Dec 10, 2021 · ended
14.014.0.0Jun 18, 2021Jul 15, 2021 · ended
13.013.0.1May 6, 2021Jun 18, 2021 · ended
12.012.0.4Dec 16, 2020May 6, 2021 · ended
11.011.0.3Jul 22, 2020Dec 16, 2020 · ended
10.010.0.2Apr 29, 2020Jul 22, 2020 · ended

Recent releases

26.8.1 Oct 13, 2026 Release notes ↗ 24security16fix
security#50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
security#51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
security#52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
26.8.0 Oct 1, 2026 → 26.8.1 Release notes ↗ 19feature12security6deprecated3breaking
securityQuickstart OID4VCI deployment - a playground for rapid prototyping with mdoc and SD-JWT credentials
securityOID4VCI Demo in Keycloak FAPI playground - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more.
security#50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering
26.7.5 Sep 30, 2026 → 26.8.1 Release notes ↗ 14security2feature24fix
security#50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc
security#51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc
security#51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services
26.7.4 Sep 16, 2026 → 26.8.1 Release notes ↗ 6security1feature9fix
security#52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
security#52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
security#52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
26.7.3 Aug 31, 2026 → 26.8.1 Release notes ↗ 21security18fix
security#50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
security#50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
security#50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations
26.7.2 Aug 19, 2026 → 26.8.1 Release notes ↗ 7security1feature16fix
security#49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies
security#50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions
security#50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix
26.7.1 Aug 5, 2026 → 26.8.1 Release notes ↗ 12security6fix
security#49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc
security#50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api
security#50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions
26.7.0 Jul 9, 2026 → 26.8.1 Release notes ↗ 16security21feature1deprecated3breaking
securityFixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
securityClient-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.
securityConfidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.
26.6.4 Jun 26, 2026 → 26.8.1 Release notes ↗ 8security1feature5fix
security#50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
security#50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
security#50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
26.6.3 Jun 4, 2026 → 26.8.1 Release notes ↗ 16security5feature19fix
security#47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui
security#47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc
security#48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services
26.6.2 May 19, 2026 → 26.8.1 Release notes ↗ 16security5feature17fix
security#47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
security#47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
security#47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services
26.6.1 Apr 15, 2026 → 26.8.1 Release notes ↗ 2security2feature13fix
security#47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core
security#47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core
26.6.0 Apr 8, 2026 → 26.8.1 Release notes ↗ 39feature1deprecated
26.5.7 Apr 2, 2026 → 26.8.1 Release notes ↗ 7security1feature1fix
security#45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api
security#45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files
security#47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api
26.5.6 Mar 19, 2026 → 26.8.1 Release notes ↗ 8security11fix
security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc
security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc
security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting

Security advisories

7.4 CVE-2026-90997 Replay protection bypass leads to unauthorized access via database driver semantics mismatch
8.1 CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
8.8 CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
6.5 CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
7.4 CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
7.4 CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
5.4 CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
8.1 CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
7.7 CVE-2026-9099 group-admin escalation to realm-admin
4.9 CVE-2026-9083 Information disclosure through arbitrary filesystem path probing
7.3 CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass
6.5 CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token
7.3 CVE-2026-9795 Privilege escalation via improper scope mapping enforcement
4.6 CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass
8.1 CVE-2026-9800 Authorization bypass via incorrect uri comparison
8.1 CVE-2026-11800 Authentication bypass via jwt algorithm confusion
7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
5.5 CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation
3.7 CVE-2025-10939 Unable to restrict access to the admin console
6.8 CVE-2025-11538 Debug default bind address

Sources

See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status