Keycloak 21.0.2 → 26.8.1
83 releases · 11 breaking changes · 268 security fixes · 62 advisories fixed
268security11breaking14deprecated528feature812fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- 8.8 CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- 6.5 CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
- 7.4 CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
- 5.4 CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
- 8.1 CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- 7.7 CVE-2026-9099 group-admin escalation to realm-admin
- 4.9 CVE-2026-9083 Information disclosure through arbitrary filesystem path probing
- 7.3 CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass
- 6.5 CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token
- 7.3 CVE-2026-9795 Privilege escalation via improper scope mapping enforcement
- 4.6 CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass
- 8.1 CVE-2026-9800 Authorization bypass via incorrect uri comparison
- 8.1 CVE-2026-11800 Authentication bypass via jwt algorithm confusion
- 7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
- 5.5 CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation
- 3.7 CVE-2025-10939 Unable to restrict access to the admin console
- 6.8 CVE-2025-11538 Debug default bind address
- 7.5 CVE-2025-11419 Keycloak TLS Client-Initiated Renegotiation Denial of Service
- 4.9 CVE-2025-9162 Variable resolution on imports can expose environment variables
- 4.3 CVE-2025-10044 Keycloak error_description injection on error pages that can trigger phishing attacks
- 5.3 CVE-2025-8419 Keycloak SMTP Inject Vulnerability
- medium CVE-2025-7365 Phishing attack via email verification step in first login flow
- high CVE-2025-3501 Keycloak hostname verification
- medium CVE-2025-3910 Two factor authentication bypass
- 5.4 CVE-2025-1391 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
- 5.4 CVE-2025-0604 Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
- 6.5 CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers
- 4.9 CVE-2024-11736 Unrestricted admin use of system and environment variables
- 5.9 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process
- 6.5 CVE-2024-10270 Inefficient Regular Expression Complexity in org.keycloak:keycloak-services
- 2.7 CVE-2024-10492 Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
- 4.7 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
- 7.1 CVE-2024-10039 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
- 7.1 CVE-2024-7341 Session fixation in Elytron SAML adapters
- 6.1 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
- 7.7 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
- 4.8 CVE-2024-7318 One Time Passcode (OTP) is valid longer than expiration timeSeverity
- medium CVE-2024-4629 Potential bypass of brute force protection
- 2.7 CVE-2024-5967 Leak of configured LDAP bind credentials through the Keycloak admin console
- low CVE-2021-3754 Improper input validation on Keycloak allows using email as username
- low CVE-2024-1722 DoS via account lockout
- medium CVE-2024-3656 Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities
- high CVE-2024-4540 Exposure of sensitive information in Pushed Authorization Requests (PAR)
- medium CVE-2023-3597 Secondary factor bypass in step-up authentication
- medium CVE-2023-6544 Authorization Bypass
- high CVE-2024-2419 Path traversal in the redirect validation
- high CVE-2023-6717 XSS via assertion consumer service URL in SAML POST-binding flow
- low CVE-2023-0657 Impersonation via logout token exchange
- medium CVE-2023-6787 Session hijacking via re-authentication
- high CVE-2024-1132 Path transversal in redirection validation
- high CVE-2024-1249 Unvalidated cross-origin messages in checkLoginIframe leads to DDoS
- low CVE-2023-6484 Log Injection during WebAuthn authentication or registration
- medium CVE-2023-6927 keycloak-core: open redirect via "form_post.jwt" JARM response mode
- 7.1 CVE-2023-6291 The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
- medium CVE-2023-6134 Reflected XSS via wildcard in OIDC redirect_uri
- low CVE-2022-2232 LDAP Injection on UsernameForm Login
- medium CVE-2023-0105 Impersonation and lockout possible through incorrect handling of email trust
- medium CVE-2023-2585 Client Spoofing within the Keycloak Device Authorisation Grant
- low CVE-2023-1664 Untrusted Certificate Validation
- low CVE-2022-4361 Cross-site scripting when validating URI-schemes on SAML and OIDC
- 7.1 CVE-2023-2422 Improper Client Certificate Validation for OAuth/OpenID clients
Breaking changes
- breaking #51897 Deprecate route from AUTH_SESSION_ID cookie for sticky sessions in 26.8.0
- breaking #52130 Deprecate clusterless feature in 26.8.0
- breaking #52480 EOL Keycloak Realm Operator in 26.8.0
- breaking #44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering in 26.7.0
- breaking #48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated in 26.7.0
- breaking #49270 Remove the batching option for the persistent sessions in 26.7.0
- breaking #42905 Remove PostgreSQL 13.x support in 26.5.0
- breaking ServerCookie - replaced by NewCookie.Builder in 25.0.0
- breaking LocaleSelectorProvider.KEYCLOAK_LOCALE - replaced by CookieType.LOCALE in 25.0.0
- breaking HttpCookie - replaced by NewCookie.Builder in 25.0.0
- breaking HttpResponse.setCookieIfAbsent(HttpCookie cookie) - replaced by HttpResponse.setCookieIfAbsent(NewCookie cookie) in 25.0.0
Security changes
- security #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering in 26.8.1
- security #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc in 26.8.1
- security #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering in 26.8.1
- security #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
- security #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions in 26.8.1
- security #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication in 26.8.1
- security #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api in 26.8.1
- security #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services in 26.8.1
- security #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services in 26.8.1
- security #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc in 26.8.1
- security #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication in 26.8.1
- security #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
- security #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication in 26.8.1
- security #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api in 26.8.1
- security #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard in 26.8.1
- security #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability in 26.8.1
- security #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies in 26.8.1
- security #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies in 26.8.1
- security #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication in 26.8.1
- security #53582 Multiple CVEs in simple-git dependencies in 26.8.1
- security #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui in 26.8.1
- security #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api in 26.8.1
- security #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions in 26.8.1
- security #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication in 26.8.1
- security Quickstart OID4VCI deployment - a playground for rapid prototyping with mdoc and SD-JWT credentials in 26.8.0
- security OID4VCI Demo in Keycloak FAPI playground - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more. in 26.8.0
- security #50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering in 26.8.0
- security #50618 [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified oidc in 26.8.0
- security #51865 [CVE-2026-19608] Name-only group claims let same-name groups satisfy path-specific group policies authorization-services in 26.8.0
- security #52168 CVE-2026-54515 CVE-2026-59889 com.fasterxml.jackson.core:jackson-databind 2.22.0 dist/quarkus in 26.8.0
- security #52169 CVE-2026-59903 io.netty:netty-codec-http:4.1.136.Final dist/quarkus in 26.8.0
- security #51699 Missing security headers on root-path redirect when http-relative-path is configured dist/quarkus in 26.8.0
- security #52642 SCIM user deletion skips security-state cleanup in 26.8.0
- security #52645 Bulk HQL executeUpdate bypasses AsyncCommitIntegrator security classification in 26.8.0
- security #52696 Recovered sites can enforce stale security configuration for up to one hour storage in 26.8.0
- security #52676 CVE-2026-4633 User enumeration via identity-first login when Organizations feature is enabled organizations in 26.8.0
- security #50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc in 26.7.5
- security #51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc in 26.7.5
- security #51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services in 26.7.5
- security #51281 [CVE-2026-18207] Source-group condition matches duplicate group names and can skip negative-logic enforcement oidc in 26.7.5
- security #51284 [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim oidc in 26.7.5
- security #51285 [CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains oidc in 26.7.5
- security #51781 [CVE-2026-18217] SAML Redirect Binding Parameter Pollution saml in 26.7.5
- security #52531 CVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependencies in 26.7.5
- security #52692 [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET oidc in 26.7.5
- security #52783 [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts (sibling of CVE-2026-9798) oidc in 26.7.5
- security #52888 CVE-2026-84939 org.freemarker:freemarker in 26.7.5
- security #52972 CVE-2026-8798 org.bouncycastle:bc-fips dependencies in 26.7.5
- security #52974 CVE-2026-13505 org.bouncycastle:bc-fips dependencies in 26.7.5
- security #53074 [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client token-exchange in 26.7.5
- security #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts in 26.7.4
- security #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching in 26.7.4
- security #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher in 26.7.4
- security #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout in 26.7.4
- security #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator in 26.7.4
- security #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state in 26.7.4
- security #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap in 26.7.3
- security #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc in 26.7.3
- security #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations in 26.7.3
- security #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions in 26.7.3
- security #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac in 26.7.3
- security #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc in 26.7.3
- security #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions in 26.7.3
- security #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions in 26.7.3
- security #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions in 26.7.3
- security #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc in 26.7.3
- security #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange in 26.7.3
- security #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations in 26.7.3
- security #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc in 26.7.3
- security #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange in 26.7.3
- security #51378 [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions in 26.7.3
- security #51379 [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services in 26.7.3
- security #51380 [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc in 26.7.3
- security #51382 [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc in 26.7.3
- security #51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core in 26.7.3
- security #52028 [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc in 26.7.3
- security #52017 SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml in 26.7.3
- security #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies in 26.7.2
- security #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions in 26.7.2
- security #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix in 26.7.2
- security #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions in 26.7.2
- security #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc in 26.7.2
- security #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client in 26.7.2
- security #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass in 26.7.2
- security #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc in 26.7.1
- security #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api in 26.7.1
- security #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions in 26.7.1
- security #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions in 26.7.1
- security #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions in 26.7.1
- security #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher in 26.7.1
- security #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation in 26.7.1
- security #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text in 26.7.1
- security #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction in 26.7.1
- security #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation in 26.7.1
- security #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary in 26.7.1
- security #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers in 26.7.1
- security Fixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher in 26.7.0
- security Client-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. in 26.7.0
- security Confidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. in 26.7.0
- security OAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. in 26.7.0
- security Session-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. in 26.7.0
- security Polishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API. in 26.7.0
- security Lots of bugs fixed. Improved specification compliance. in 26.7.0
- security Conformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA). in 26.7.0
- security Management of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from… in 26.7.0
- security Pre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code in 26.7.0
- security Support for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults… in 26.7.0
- security Documentation updated and improved in 26.7.0
- security #49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac in 26.7.0
- security #49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc in 26.7.0
- security #49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc in 26.7.0
- security #49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions in 26.7.0
- security #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin in 26.6.4
- security #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing in 26.6.4
- security #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass in 26.6.4
- security #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token in 26.6.4
- security #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement in 26.6.4
- security #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass in 26.6.4
- security #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison in 26.6.4
- security #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion in 26.6.4
- security #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui in 26.6.3
- security #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc in 26.6.3
- security #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services in 26.6.3
- security #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api in 26.6.3
- security #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization in 26.6.3
- security #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc in 26.6.3
- security #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn in 26.6.3
- security #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions in 26.6.3
- security #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering in 26.6.3
- security #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc in 26.6.3
- security #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml in 26.6.3
- security #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations in 26.6.3
- security #49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api in 26.6.3
- security #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap in 26.6.3
- security #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc in 26.6.3
- security #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc in 26.6.3
- security #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service in 26.6.2
- security #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing in 26.6.2
- security #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services in 26.6.2
- security #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations in 26.6.2
- security #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core in 26.6.2
- security #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn in 26.6.2
- security #48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core in 26.6.2
- security #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint in 26.6.2
- security #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak in 26.6.2
- security #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data in 26.6.2
- security #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover in 26.6.2
- security #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account in 26.6.2
- security #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens in 26.6.2
- security #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission in 26.6.2
- security #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) in 26.6.2
- security #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration in 26.6.2
- security #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core in 26.6.1
- security #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core in 26.6.1
- security #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api in 26.5.7
- security #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files in 26.5.7
- security #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api in 26.5.7
- security #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing in 26.5.7
- security #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants in 26.5.7
- security #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint in 26.5.7
- security #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw in 26.5.7
- security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
- security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
- security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
- security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
- security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
- security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
- security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
- security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
- security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
- security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
- security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
- security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
- security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
- security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
- security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
- security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
- security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
- security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
- security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
- security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
- security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3
- security #44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies in 26.5.2
- security #45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability in 26.5.2
- security #45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users in 26.5.2
- security #44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation in 26.4.6
- security Fixes CVE-2025-11538: Debug default bind address in 26.4.4
- security Fixes CVE-2025-10939: Unable to restrict access to the admin console in 26.4.4
- security Fixes CVE-2025-11419: Keycloak TLS Client-Initiated Renegotiation Denial of Service in 26.4.1
- security Possibility to make only refresh tokens of a public client to be DPoP bound and omit the binding of an access token. in 26.4.0
- security All Keycloak endpoints that are secured by bearer token can now handle DPoP tokens. This includes, for example, the Admin REST API and Account REST API. in 26.4.0
- security Possibility to require the dpop_jkt parameter in the OIDC authentication request. in 26.4.0
- security #41184 CVE-2025-48924 - Uncontrolled Recursion vulnerability in Apache Commons Lang in 26.4.0
- security #41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core in 26.4.0
- security #42491 CVE-2025-58057 - Netty BrotliDecoder / Data Amplification vulnerability dist/quarkus in 26.3.5
- security #42492 CVE-2025-58056 - Netty HTTP Request Smuggling vulnerability dist/quarkus in 26.3.5
- security Fixes CVE-2025-9162: Variable resolution on imports can expose environment variables in 26.3.4
- security Fixes CVE-2025-10044: Keycloak error_description injection on error pages that can trigger phishing attacks in 26.3.4
- security Fixes CVE-2025-8419: Keycloak SMTP Inject Vulnerability in 26.3.3
- security #41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core in 26.3.3
- security #40553 Upgrade org.postgresql:postgresql to version 42.7.7 to address CVE-2025-49146 dependencies in 26.3.2
- security #40736 CVE-2025-49574 - Exposure of Resource to Wrong Sphere vulnerability in io.vertx:vertx-core dependencies in 26.3.2
- security Fixes CVE-2025-7784: Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled) in 26.3.0
- security #39349 CVE-2025-3910 Two factor authentication bypass in 26.3.0
- security #39350 CVE-2025-3501 Keycloak hostname verification in 26.3.0
- security #39349 CVE-2025-3910 Two factor authentication bypass in 26.2.2
- security #39350 CVE-2025-3501 Keycloak hostname verification in 26.2.2
- security #36195 CVE-2024-12397 - HTTP Request Smuggling in io.quarkus.http:quarkus-http-core dist/quarkus in 26.2.0
- security #36965 CVE-2025-0736 Error during JGroups channel creation may reveal secure information in 26.2.0
- security #37360 CVE-2024-47072 - XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream in 26.2.0
- security Fixes CVE-2025-1391: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims in 26.1.3
- security Fixes CVE-2025-0604: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak in 26.1.3
- security #36965 CVE-2025-0736 Error during JGroups channel creation may reveal secure information in 26.1.3
- security #37360 CVE-2024-47072 - XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream in 26.1.3
- security #33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus in 26.1.0
- security #34794 CVE-2024-10973 - Cleartext Transmission of Sensitive Information in org.keycloak:keycloak-quarkus-server in 26.1.0
- security #35213 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process in 26.1.0
- security #35214 CVE-2024-10270 Potential Denial of Service in 26.1.0
- security #35215 CVE-2024-10492 Keycloak path trasversal in 26.1.0
- security #35216 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability in 26.1.0
- security #35217 CVE-2024-10039 Bypassing mTLS validation in 26.1.0
- security #36394 CVE-2024-11736 Unrestricted admin use of system and environment variables in 26.1.0
- security #36395 CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers in 26.1.0
- security #36394 CVE-2024-11736 Unrestricted admin use of system and environment variables in 26.0.8
- security #36395 CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers in 26.0.8
- security Fixes CVE-2024-10973: CLI option for encrypted JGroups ignored in 26.0.6
- security #35213 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process in 26.0.6
- security #35214 CVE-2024-10270 Potential Denial of Service in 26.0.6
- security #35215 CVE-2024-10492 Keycloak path trasversal in 26.0.6
- security #35216 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability in 26.0.6
- security #35217 CVE-2024-10039 Bypassing mTLS validation in 26.0.6
- security #33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus in 26.0.4
- security #32789 CVE-2024-7318 - Use of a Key Past its Expiration Date in org.keycloak:keycloak-core in 26.0.0
- security #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect in 26.0.0
- security #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak in 26.0.0
- security #33156 CVE-2024-7254 - Stack-based Buffer Overflow in com.google.protobuf:protobuf-java dist/quarkus in 26.0.0
- security #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect in 25.0.6
- security #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak in 25.0.6
- security #32754 CVE-2024-7341 Session fixation in the SAML adapters adapter/saml in 25.0.5
- security Fixes CVE-2024-4629: Potential bypass of brute force protection in 25.0.4
- security #29607 CVE-2024-30172 - Infinite loop in org.bouncycastle:bcprov-jdk18on dependencies in 25.0.0
- security #29608 CVE-2024-30171 - Observable Discrepancy in org.bouncycastle:bcprov-jdk18on dependencies in 25.0.0
- security #29609 CVE-2024-29857 - Allocation of Resources Without Limits or Throttling in org.bouncycastle:bcprov-jdk18on dependencies in 25.0.0
- security Fixes CVE-2024-3656: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities in 24.0.5
- security Fixes CVE-2024-4540: Exposure of sensitive information in Pushed Authorization Requests (PAR) in 24.0.5
- security Fixes CVE-2023-3597: Secondary factor bypass in step-up authentication in 24.0.3
- security Fixes CVE-2023-6544: Authorization Bypass in 24.0.3
- security Fixes CVE-2024-2419: Path traversal in the redirect validation in 24.0.3
- security Fixes CVE-2023-6717: XSS via assertion consumer service URL in SAML POST-binding flow in 24.0.3
- security Fixes CVE-2023-0657: Impersonation via logout token exchange in 24.0.3
- security Fixes CVE-2023-6787: Session hijacking via re-authentication in 24.0.3
- security Fixes CVE-2024-1132: Path transversal in redirection validation in 24.0.3
- security Fixes CVE-2024-1249: Unvalidated cross-origin messages in checkLoginIframe leads to DDoS in 24.0.3
- security Fixes CVE-2021-3754: Improper input validation on Keycloak allows using email as username in 24.0.1
- security Fixes CVE-2024-1722: DoS via account lockout in 24.0.0
- security Fixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration in 24.0.0
- security #24506 Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 dependencies in 24.0.0
- security Fixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration in 23.0.5
- security Fixes CVE-2023-6927: keycloak-core: open redirect via "form_post.jwt" JARM response mode in 23.0.4
- security Fixes CVE-2023-6291: The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted in 23.0.3
- security Fixes CVE-2023-6134: Reflected XSS via wildcard in OIDC redirect_uri in 23.0.3
- security Fixes CVE-2022-2232: LDAP Injection on UsernameForm Login in 23.0.1
- security Fixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration in 23.0.0
- security Fixes CVE-2023-0105: Impersonation and lockout possible through incorrect handling of email trust in 22.0.1
- security Fixes CVE-2023-2422: Improper Client Certificate Validation for OAuth/OpenID clients in 21.1.2
- security Fixes CVE-2023-2585: Client Spoofing within the Keycloak Device Authorisation Grant in 21.1.2
- security Fixes CVE-2023-1664: Untrusted Certificate Validation in 21.1.2
- security Fixes CVE-2022-4361: Cross-site scripting when validating URI-schemes on SAML and OIDC in 21.1.2
Deprecations
- deprecated #49239 Stop storing client private keys in the database and deprecate generate endpoints admin/rbac in 26.8.0
- deprecated #44062 Should Kerberos Credential delegation be deprecated? in 26.8.0
- deprecated #51921 Deprecate legacy OIDC client switches from 'OpenID Connect Compatibility Modes' oidc in 26.8.0
- deprecated #52121 Deprecate volatile sessions and allow opting out of session caching in 26.8.0
- deprecated #52923 Deprecate 'Full scope allowed' client switch oidc in 26.8.0
- deprecated #53219 Deprecate other client registration providers than OIDC in 26.8.0
- deprecated #49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui in 26.7.0
- deprecated #45156 Deprecate Token Exchange v1 in 26.6.0
- deprecated #44121 Deprecate Fine-Grained Admin Permissions v1 admin/fine-grained-permissions in 26.5.0
- deprecated #525 Drop support for end-of-life versions of Node.js in 26.1.2
- deprecated #600 De-couple quickstarts from statically served Keycloak JS quickstarts in 26.0.0
- deprecated AccessToken in 25.0.0
- deprecated IDToken in 25.0.0
- deprecated JsonWebToken in 25.0.0
Every release in between
security#50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
security#51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
security#52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
security#53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
security#53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
security#53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
security#53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
security#53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
security#53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
security#53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
security#53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
security#53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
security#53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
security#53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
security#53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
security#53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
security#53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
security#53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
security#53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
security#53582 Multiple CVEs in simple-git dependencies
security#53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
security#53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api
security#53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
fix#51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
fix#52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
fix#52362 HttpServerUtil.sendResponse drops the headers it is given core
fix#52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
security#52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
fix#52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
fix#53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
fix#53142 Realm settings - security defenses admin/ui
fix#53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
fix#53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
fix#53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
fix#53505 Broken link to FIPS documentation docs
fix#53567 Broken link to vault documentation in downstream docs
fix#53569 Fix broken link to migrating the database in downstream docs
fix#53571 Broken link in Operator Guide docs
fix#53624 Multiple link issues including incorrect names and upstream only coding docs
fix#53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
+20 more items in the release notesfeatureIssue and verify digital wallet credentials with OID4VCI and OID4VP
featureAutomate user provisioning across identity systems with the SCIM API
featureRun multi-cluster deployments without an external cache using stateless mode (now supported)
featureSimpler administration with automatic index creation, reduced memory usage, and enhanced HTTP performance
featureToken exchange delegation for AI agents and automation with consent and FGAP authorization
securityQuickstart OID4VCI deployment - a playground for rapid prototyping with mdoc and SD-JWT credentials
securityOID4VCI Demo in Keycloak FAPI playground - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more.
security#50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering
security#50618 [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified oidc
security#51865 [CVE-2026-19608] Name-only group claims let same-name groups satisfy path-specific group policies authorization-services
security#52168 CVE-2026-54515 CVE-2026-59889 com.fasterxml.jackson.core:jackson-databind 2.22.0 dist/quarkus
security#52169 CVE-2026-59903 io.netty:netty-codec-http:4.1.136.Final dist/quarkus
feature#47295 LDAP bind credentials sent to new server when connection URL is changed ldap
deprecated#49239 Stop storing client private keys in the database and deprecate generate endpoints admin/rbac
feature#49784 UserInfo Endpoint: Add null-check for SignatureProvider when validating JWT bearer tokens oidc
feature#50469 Parameterized Scopes: First-match prefix resolution allows permissive scope to shadow stricter scope
feature#50520 OID4VCI: Unbounded expire parameter on /create-credential-offer allows indefinite pre-auth codes oid4vc
feature#50999 Same-second refresh-token rotation allows stale token replay oidc
feature#51211 SAML: Add signature verification for inbound LogoutResponse messages saml
security#51699 Missing security headers on root-path redirect when http-relative-path is configured dist/quarkus
feature#52058 Add warning about dynamic urls to reflect the danger of hostname pollution docs
security#52642 SCIM user deletion skips security-state cleanup
security#52645 Bulk HQL executeUpdate bypasses AsyncCommitIntegrator security classification
feature#52691 Token exchange provider routing allows delegation tokens to bypass actor validation via standard exchange token-exchange
security#52696 Recovered sites can enforce stale security configuration for up to one hour storage
deprecated#44062 Should Kerberos Credential delegation be deprecated?
deprecated#51921 Deprecate legacy OIDC client switches from 'OpenID Connect Compatibility Modes' oidc
deprecated#52121 Deprecate volatile sessions and allow opting out of session caching
deprecated#52923 Deprecate 'Full scope allowed' client switch oidc
deprecated#53219 Deprecate other client registration providers than OIDC
breaking#51897 Deprecate route from AUTH_SESSION_ID cookie for sticky sessions
breaking#52130 Deprecate clusterless feature
breaking#52480 EOL Keycloak Realm Operator
feature#16738 Supported client secret rotation
feature#48899 SSF: Add support for RiscAccountPurged event ssf
feature#50644 [OID4VP] Support direct_post.jwt (encrypted) response mode authentication
feature#50876 update admin client tests to use sort and filter
feature#16947 group.spec.ts does not contain example of how to add attributes while creating groups admin/client-js
feature#22524 Improve WebAuthn error messages translations
security#52676 CVE-2026-4633 User enumeration via identity-first login when Organizations feature is enabled organizations
+331 more items in the release notessecurity#50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc
security#51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc
security#51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services
security#51281 [CVE-2026-18207] Source-group condition matches duplicate group names and can skip negative-logic enforcement oidc
security#51284 [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim oidc
security#51285 [CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains oidc
security#51781 [CVE-2026-18217] SAML Redirect Binding Parameter Pollution saml
security#52531 CVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependencies
security#52692 [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET oidc
security#52783 [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts (sibling of CVE-2026-9798) oidc
security#52888 CVE-2026-84939 org.freemarker:freemarker
security#52972 CVE-2026-8798 org.bouncycastle:bc-fips dependencies
security#52974 CVE-2026-13505 org.bouncycastle:bc-fips dependencies
security#53074 [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client token-exchange
feature#51340 DCR: Registration access token allows protocol switch from OIDC to SAML oidc
feature#52357 Upgrade to Quarkus 3.33.4 dist/quarkus
fix#50739 keycloak 26.7.0 sha1 file is missing dist/quarkus
fix#50903 Missing input length validation on username field causes outsized log generation in /login-actions/authenticate authentication
fix#51065 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested ci
fix#51067 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested ci
fix#51304 Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore. infinispan
fix#51761 PAR request URI lifespan is used as a hard cap on interactive login duration oidc
fix#51778 [quarkus-next] BouncyCastle 1.85 breaks SAML client creation when client ID exceeds 64 characters dist/quarkus
fix#52033 Improve retrieval of large read-only resources via admin API storage
fix#52088 New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts infinispan
fix#52153 DEBUG logging breaks persistent client session locking storage
fix#52193 Identity Provider Mappers - organization group targets do not resolve organizations
fix#52257 Event listeners receive the wrong event type when an EventBuilder is reused (e.g. FEDERATED_IDENTITY_LINK is logged and emailed as LOGIN) core
fix#52309 Admin Permissions filtering is applied to organization lookups during end-user authentication organizations
fix#52327 surefire-junit-platform not cached, causing intermittent test failures in CI ci
fix#52329 Flaky test: FlowTest.testRemoveExecutionSubflow fails with stale DELETE admin event testsuite
fix#52331 Flaky SCIM FilterTest.testFilterGroupsByMetaTimestamps due to same-millisecond timing saml
fix#52415 Flaky test: WebAuthnTransportLocaleTest.localizationTransportInternal fails with "Cannot logout user" testsuite
fix#52423 Flaky test: MySQLDistTest fails with "process hasn't exited" on slow CI runners testsuite
fix#52428 Flaky test: AttackDetectionResourceTest due to DefaultBlockingBruteForceProtector concurrent login blocking authentication
fix#52433 Flaky test: registration-policies.spec.ts kebab menu "Delete" item not found after toggle click testsuite
fix#52435 Flaky test: timeout.spec.ts fails with "fetch failed" due to server not ready and hardcoded port testsuite
fix#52460 Remove azure-cli version pin after runner image update removes apt source ci
fix#52487 Managing Identity Providers in the admin UI now requires client roles in the realm admin/ui
fix#52490 Flaky Admin UI E2E test: "Should show items on next page" in scope.spec.ts ci
+7 more items in the release notessecurity#52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
security#52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
security#52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
security#52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
security#52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
security#52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state
feature#52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus
fix#49635 Performance issue with 26.6.2 dist/quarkus
fix#51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci
fix#52015 New links errors for https://quarkus.io/guides docs
fix#52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan
fix#52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api
fix#52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus
fix#52241 Clicking on a sub group in the admin console throws an exception admin/ui
fix#52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite
fix#52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite
security#50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
security#50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
security#50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations
security#51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions
security#51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac
security#51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc
security#51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions
security#51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions
security#51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions
security#51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc
security#51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange
security#51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations
security#51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc
security#51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange
security#51378 [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions
security#51379 [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services
security#51380 [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc
security#51382 [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc
security#51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core
security#52028 [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc
other#50581 Admin API: User/group role-mapping endpoints disclose hidden client role metadata under FGAP v2 admin/fine-grained-permissions
fix#50825 Creating an organization without a domain leads to an error organizations
fix#50963 V1 token-exchange strips the DPoP sender-constraint from a bound access token token-exchange
fix#51510 SQLGrammarException: The incoming request has too many parameters core
fix#51523 Sustained high CPU on all nodes after upgrade admin/api
fix#51554 Admin API per-request cost grows super-linearly with realm count since 26.7.1 admin/api
fix#51589 NPE in RoleUtils.expandCompositeRoles when a cached client scope references a deleted role core
fix#51602 Invalid redirect on https://access.redhat.com/products/red-hat-single-sign-on/ docs
fix#51707 Lightweight access token role resolution resolves all roles across all realms on every admin API request core
fix#51712 Logout URL does not allow OIDC response parameters in its redirect_url oidc
fix#51780 SSSD CI job fails: FreeIPA container crashes on ubuntu-24.04 runner image 20260810.271 ci
fix#51785 Multiple CVEs inherited from Apache DS used for testing
fix#51790 Java Distribution IT/UT (windows-latest, temurin, 21) times out regularly ci
fix#51792 AsyncCommitIntegrator Aurora detection logs "ERROR: function aurora_version() does not exist" in the PostgreSQL server log on every startup
fix#51807 Client scope boundary bypassed when resolving admin roles via KeycloakIdentity admin/fine-grained-permissions
fix#51902 Index modifiers are not logged if an index is not created due to a threshold core
fix#51920 Error: 1020-HY000: Record has changed since last read in table OFFLINE_CLIENT_SESSION
fix#51983 [26.7.2] Regression in UI in JS keycloak-admin-client
security#52017 SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml
fix#52038 Client session note removals are not persisted with persistent user sessions core
+5 more items in the release notessecurity#49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies
security#50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions
security#50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix
security#50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions
security#51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc
security#51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client
security#51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass
other#50844 show-config prints the vault keystore password in cleartext dist/quarkus
feature#51344 Upgrade to Quarkus 3.33.3.1
fix#50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication
fix#50849 Correct SCIM name.formated scim
fix#50855 Rotated client secret remains valid when the feature is disabled oidc
fix#51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui
fix#51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core
fix#51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn
fix#51088 Verify email not working in incognito browser tab after Keycloak restart authentication
fix#51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core
fix#51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan
fix#51164 WebAuthn tests are being skipped in Github workflows workflows
fix#51182 Large HTTP/2 request headers are rejected with a bare 500 and no log; same request works over HTTP/1.1 dist/quarkus
fix#51323 Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 admin/rbac
fix#51331 Adding org member fails with 500 with stateless:v1 feature enabled organizations
fix#51407 The dist for Java API docs is empty docs
fix#51449 Incorrect query parameter name for "max"
fix#51476 Invalid link for https://www.ietf.org/rfc/rfc4559.txt docs
security#49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc
security#50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api
security#50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions
security#50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions
security#50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions
security#51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher
security#51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation
security#51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text
security#51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction
security#51471 CVE-2026-16443 SAML broker metadata import disables response signature validation
security#51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary
security#51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers
fix#50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn
fix#50750 Clustering test broken in 26.7 release branch ci
fix#50836 Kustomize cluster-wide faulty Role&RoleBinding operator
fix#50850 New Password is commited when multiple Password Reset is detected authentication
fix#50882 500 when client requests `organization` scope with it already set to `Default` authentication
fix#50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core
securityFixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
featureAutomate user provisioning with the SCIM API (preview)
featureSimplified multi-cluster high availability without external caches (preview)
featureEnhanced reverse proxy guides with blueprints for HAProxy and Traefik
featureStep-up authentication for SAML clients
securityClient-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.
securityConfidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.
securityOAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields.
securitySession-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions.
securityPolishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API.
securityLots of bugs fixed. Improved specification compliance.
securityConformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA).
securityManagement of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from…
securityPre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code
securitySupport for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults…
securityDocumentation updated and improved
featuremanage-organizations — grants full read and write access to organizations, including creating, updating, and deleting organizations and their members.
featureview-organizations — grants read-only access to organizations and their members (also requires view-users or Fine-Grained Admin Permissions for user visibility).
featurequery-organizations — grants the ability to search and list organizations without full view access, consistent with the query-users / query-clients / query-groups pattern.
security#49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac
security#49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc
security#49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc
security#49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions
deprecated#49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui
feature#50460 SSF push URL allow-list bypass via authority-attached wildcard ssf
breaking#44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering
breaking#48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated
breaking#49270 Remove the batching option for the persistent sessions
feature#9686 Store the Dynamic Scope parameter to avoid showing the Consent Screen every time there's an authentication
feature#20128 Add support for `reencrypt` OpenShift Routes to the Operator operator
feature#22042 More flexible imports in custom theme (i.e. CSS media queries) account/ui
feature#35650 Compatibility profiles
feature#44317 [OID4VCI] Add a client policy to require a credential offer
feature#46543 Step-up authentication for SAML - supported authentication
feature#48623 Make the admin client, from the admin-ui more easy to use
feature#9915 Make the consent screen text for dynamic scopes customizable with a reference to the dynamic scope parameter
feature#10696 Improve WebAuthn tests documentation testsuite
feature#12223 Dynamic scopes: requested scopes get mixed up between token requests oidc
feature#17758 [UX Review] Optimize the number box in the Time-policy creation page of client Authorization admin/ui
feature#17762 [UX Review] Optimize the initial page of Keys in OIDC client admin/ui
+317 more items in the release notessecurity#50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
security#50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
security#50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
security#50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
security#50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
security#50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
security#50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison
security#50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion
feature#50100 Upgrade to Quarkus 3.33.2.1
fix#47999 [Keycloak JavaScript CI] - Build Keycloak ci
fix#49639 Keycloak Admin Client tests fails in CI ci
fix#49700 Incorrect migration guide reference docs
fix#49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan
fix#49733 keycloak-api-docs-dist is not deployable dist/quarkus
security#47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui
security#47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc
security#48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services
security#48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api
security#48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
security#49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc
security#49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn
security#49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions
security#49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering
security#49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc
security#49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml
security#49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations
security#49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api
security#49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap
security#49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc
security#49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc
feature#48311 Upgrade to Quarkus 3.33.2 dist/quarkus
feature#48695 Add startup check for missing database indexes
feature#49148 Add SPI option to disable FD_SOCK2 failure detection
feature#49526 Update to simple-git 3.36.0
feature#49530 Update to uuid >=13.0.1
fix#45957 Handling of CORS requests in the Admin UI ineffective / open for CSRF admin/ui
fix#47036 Account ResourceService user endpoint returns excessive user data in UMA-enabled realms core
fix#48324 UMA IS_ADMIN filter breaks ticket finding authorization-services
fix#48430 Wildcard redirect URI matching does not enforce host boundary when * is placed directly after hostname oidc
fix#48432 ClientAdapter using wrong value for isFrontChannelLogout oidc
fix#48438 Keycloak 26.6.0/26.6.1 exits (code 1) ~100ms after async realm migration completes; migrations not persisted core
fix#48455 ContextNotActiveException during error handling core
fix#48464 Incomplete SCIM schema definition for objects scim
fix#48529 Broken downstream docs formatting on Kubernetes topic docs
fix#48584 Updating Keycloak to 26.6.x fails on SQL Server with case sensitive collation core
fix#48628 Client registerNode and unregisterNode endpoints fail authenticating the client core
fix#48681 ExternalLinksTest: oasis-open.org/standard/saml/ returns 403 in CI causing flaky documentation check ci
fix#48716 Missing index IDX_IDP_FOR_LOGIN and IDX_CLIENT_ATT_BY_NAME_VALUE for Microsoft SQL Server core
fix#48744 Input validation/ Unhandled NullPointerException on alg:none JWT in Bearer Authentication authentication
fix#48792 Virtual Thread checking is not working infinispan
fix#48806 NPE when accessing Account UI and the ACCOUNT feature is disabled account/api
fix#48877 Keycloak 26.6.1 does not persist UPDATE_PASSWORD for LDAP/AD federated users after temporary password reset ldap
fix#48904 Consistent 500 on DELETE of realms via non-browser clients calling REST API admin/api
fix#49058 Keycloak fails to run tests with embedded undertow dist/quarkus
+17 more items in the release notessecurity#47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
security#47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
security#47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services
security#48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations
security#48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core
security#48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn
security#48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core
security#49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint
security#49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak
security#49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data
security#49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover
security#49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account
security#49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens
security#49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission
security#49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)
security#49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration
feature#47728 Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide
feature#47734 Add dedicated "Monitoring Standbys" section to the general installation documentation
feature#48329 JDBC_PING in 26.6 should not fail with 26.7 schema changes
feature#48348 Escape expressions in JS blocks in FTL pages
feature#48687 Upgrade to Quarkus 3.33.1.1
fix#38526 Duplicate user attribute values cannot be removed core
fix#40602 Account UI reports "Something went wrong" when opening an unknown path account/ui
fix#47882 Broken link in deploy-cnpg docs
fix#47901 Realm import with --import-realm fails with ModelValidationException when Admin Permissions is enabled admin/fine-grained-permissions
fix#47915 FreeMarker templates allow instantiation of new objects and even running OS commands login/ui
fix#47987 FGAP v2 Specific Group permission has no scopes found in resource admin/fine-grained-permissions
fix#48030 Update to operator version 26.6.0 needs deletion of all objects operator
fix#48040 User session limit generates fatal error authentication
fix#48094 Wrong referenced resource type in Workflow handling for clients core
fix#48123 Clarify canonicalization in X.509 authentication authentication
fix#48143 Ordering of permission and policy calls leads to exposure of a client ID admin/api
fix#48185 Deleted workflow still attempting to run workflows
fix#48241 JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title authentication
fix#48259 Kubernetes identity providers docs still mention it to be a preview feature docs
fix#48313 No escape approach for JS code inside the front channel logout FTL login/ui
fix#48536 Review migration guide for rolling updates changes workflows
fix#48629 WindowsServiceDistTest.testServiceLifecycle fails on slower runners due to insufficient startup timeout ci
security#47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core
security#47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core
feature#47839 Update CloudNativePG to 1.29
feature#47909 Database data at rest encryption
fix#47435 AuroraDB IT CI workflow not cleaning up databases testsuite
fix#47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail testsuite
fix#47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope oidc
fix#47827 az vm create fails with JSON parsing error ci
fix#47872 v26.6.0 Operator flood logs with warnings operator
fix#47889 Not possible to sync latest keycloak-admin-client to keycloak-client admin/client-java
fix#47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0 admin/client-js
fix#47905 invalid package reference in keycloak-admin-ui admin/ui
fix#47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication organizations
fix#47929 User profile multiselect options not highlighted as selected in dropdown admin/ui
fix#47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint identity-brokering
fix#48015 Missing explicit docs anchor for organizations docs
fix#48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap dist/quarkus
featureJWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions.
featureFederated client authentication, eliminating the need to manage individual client secrets in Keycloak.
featureWorkflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management.
featureZero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime.
featureThe Keycloak Test Framework, replacing the previous Arquillian-based solution.
featureConfigure TLS for the database connection.
featureDatabase connection timeouts.
featureTransaction timeouts with production-ready defaults.
feature/var/run/secrets/kubernetes.io/serviceaccount/ca.crt (Kubernetes service account CA)
feature/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt (OpenShift service CA)
deprecated#45156 Deprecate Token Exchange v1
feature#10155 Step-up authentication for SAML clients authentication
feature#13102 Add support for specifying `client.secret` using vault core
feature#39888 Workflows
feature#42634 Federated client authentication
feature#43144 OAuth Identity and Authorization Chaining Across Domains
feature#43146 New test framework
feature#43152 Authorization Grants
feature#43252 Zero-downtime upgrades between patch releases of Keycloak
feature#43257 Support a Kubernetes Native Database
feature#43507 Add support for Organization-specific Groups
feature#43576 Authorization grant for social providers token-exchange/federated
feature#44833 [OID4VCI] Make natural_person configuration available in all formats oid4vc
feature#45106 OAuth Client ID Metadata Document
feature#45284 CIMD - Persistent CIMD oidc
feature#46633 keycloak operator: add support for different port and name for the kubernetes service definition in the keycloak CRD
feature#47011 Add debug helper utility to the test framework test-framework
feature#10618 Enhancements to logging config dist/quarkus
feature#14523 Add support for enforced password change with LDAP federation ldap
feature#17904 Support RTL UI account/ui
feature#19374 Allow absolute path for cache-config-file? dist/quarkus
feature#19453 The default database transaction timeout should not be applied to Liquibase or data migrations dist/quarkus
feature#20618 Support enabling access logs dist/quarkus
feature#27986 Remove Liquibase dependency version from Keycloak root pom
feature#33160 Add support for X509 client certificate lookup for Envoy
feature#33198 Introduce `resourcesCommonUrl` for E-Mail templates core
feature#33818 Request for Enhancement: Make x509cert-lookup SPI public
feature#34435 OTEL: Add tracing ID to user facing error message observability
feature#35298 Reverse proxy provided context path not working despite setting X-Forwarded-Prefix header dist/quarkus
feature#36226 Provide a read only view of Identity Provider Mappers configuration screen to the Keycloak Admin UI
+333 more items in the release notessecurity#45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api
security#45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files
security#47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api
security#47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing
security#47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
security#47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
security#47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
feature#46631 Upgrade to Quarkus 3.27.3 dist/quarkus
fix#45204 Call without Host header throws uncaught error core
security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc
security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc
security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting
security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure
security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission
security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core
security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile
security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations
fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage
fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication
fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api
fix#46379 Unexpected error when logging out with offline session and external IDP oidc
fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator
fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap
fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core
fix#46656 Em-Hyphens in SPI options on cache configuration page docs
fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan
fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange
fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations
security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login
security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService
security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login
security#46912 CVE-2026-2092 saml broker encrypted assertion injection
security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml
security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass
security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information
security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml
security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol
feature#46090 New key affinity for session ids
fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc
fix#45065 Client deletion timeout due to large number of client roles storage
fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml
fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc
fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations
fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator
fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan
fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan
fix#46150 Move upgrading note for SAML to 26.5.4 docs
fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript
fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan
fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc
fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci
security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant
security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration
security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers
security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/
feature#45892 Upgrade minikube for CI tests operator
fix#44379 Node.js admin client does not refresh tokens admin/client-js
fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus
fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus
fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus
fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite
fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci
fix#45755 Broken YAML indentation in operator rolling updates doc docs
fix#45780 Remove fatal log messages from `ConsistentHash`
security#44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies
feature#43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging
feature#45498 Ignore OpenAPI artifacts when disabled dist/quarkus
fix#44785 Can not get through SSO login if using a custom attribute with default value user-profile
fix#45015 Deadlock in Infinispan virtual threads infinispan
fix#45250 IDToken contains duplicate address claims oidc
fix#45333 User admin events don't show role, group mapping, reset password like events admin/ui
fix#45396 Database Migration fails when updating to 26.5.0 on MS SQL core
fix#45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan
fix#45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile
fix#45474 Admin REST API document is not up to date docs
fix#45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations
fix#45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus
security#45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability
fix#45584 Keycloak supported specs should list DPoP as supported oidc
fix#45590 OIDCIdentityProviderConfig issuer configuration token-exchange
fix#45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations
security#45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users
feature#44863 x-robots HTTP header missing for static Keycloak resources, and REST endpoint responses
feature#45009 Performance improvement: Missing indexes on BROKER_LINK table columns
feature#45182 Allow full managing of realms from master realm without global admin role
fix#43975 Test Framework -> Embedded server -> Maven execution failure: Failed to read script file from: scripts/default-policy.js test-framework
fix#44371 403 Forbidden when assigning realm-management client roles despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions
fix#44417 Security issue with Organization feature exposes and fills the account name automatically in user/password form organizations
fix#44783 Create Realm button is missing when user has create-realm role admin/ui
fix#44860 Admin UI: slow response time listing second user page admin/ui
fix#45003 Bug in JWTClientAuthenticator and JWTClientSecretAuthenticator causes NPE authentication
fix#45093 Enable visibility of Role Mapping tab for users with view-users role admin/ui
fix#45107 Failed upgrade to 26.4.7 - sql generated for manual database upgrade contains invalid statements storage
fix#45116 Realm-level admininistrators can no longer use Admin Console since 26.3.0 (UI fails to render) admin/ui
fix#45185 ExternalLinkTest fails due to missing _adding_context_for_log_messages anchor docs
fix#45226 Failure when decrypting SAML Response since 26.5.0 saml
fix#45239 Upgrade to 26.5.0 failing due to FK_ORG_INVITATION_ORG constraint organizations
fix#45257 Creating IdentityProvider with latest java admin-client may fail against Keycloak server 26.4 or older admin/client-java
fix#45307 UI Bug: WebAuthn passkey list is broken in keycloak v2 theme login/ui
featureWorkflows to automate administrative tasks and process within a realm.
featureJWT Authorization Grants, our recommended alternative to external to internal token exchange.
featureGuide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers.
featureAuthenticating clients with Kubernetes service account tokens to avoid static client secrets.
featureOpenTelemetry support for metrics and logging, combining all observability information in this popular standard.
featureView all sent invitations with their current status (Pending, Expired)
featureResend pending invitations to recipients
featureDelete invitation records from the system
featureFilter invitations by status for easier management
deprecated#44121 Deprecate Fine-Grained Admin Permissions v1 admin/fine-grained-permissions
breaking#42905 Remove PostgreSQL 13.x support
feature#20761 Support Caddy as a Reverse Proxy Provider for Client Certificate Authentication core
feature#37704 Support for running Keycloak as a Windows Service
feature#38809 Feature Request: Track Pending Organization Invitations in Keycloak Admin Console
feature#39221 Admin API v2: Blueprint
feature#41261 OpenTelemetry Support observability
feature#42482 Possibility to backchannel logout the clients belonging to a specific user session
feature#42912 Containers for ppc64le
feature#43020 Secure Client-Initiated Renegotiation - disable by default dist/quarkus
feature#43106 Expose scheduled tasks and start time
feature#44312 Add support to use `kcw` with remote test server test-framework
feature#44458 Expose a configuration option to always display a logout confirmation screen
feature#8863 Add CORS support to OIDC dynamic client registration endpoints
feature#10388 Allow to hide client scopes from scopes_supported in discovery endpoint
feature#12682 Allow CORS Access-Control-Allow-Headers customization core
feature#14509 Allow configuration for SMTP timeouts via configuration
feature#15502 Ability to remove offline_access tokens from the Account Management client and/or Admin interface core
feature#17268 [KC 20+] Obsolete/wrong documentation about service accounts?
feature#22938 Fine-grained admin permission client manage does not work for an Authorization enabled client admin/fine-grained-permissions
feature#33009 Delete Client and role's admin event doesn't have representation while other delete entities have the representation admin/ui
feature#33146 Prevent users configuring max-count=-1 for caches with a default upper-bound infinispan
feature#35836 SMTP Timeout Override
feature#38843 Set `automountServiceAccountToken: false` on Keycloak pods operator
feature#39881 Picture of the token-exchange flow in the documentation docs
feature#40799 Provide a way to add custom labels to Realm Import job of Keycloak operator
feature#41006 [OTel] Micrometer to OpenTelemetry bridge support for metrics observability
feature#41007 Including OTLP headers for authorization
feature#41019 Validate client session session timeout and lifetime settings on edit authentication
feature#41205 Make MDC logging supported
feature#41263 [OTel] Provide general options for telemetry settings observability
+302 more items in the release notesfeature#43156 [Docs] Warn users about printing headers in HTTP access logs docs
feature#43643 Upgrade to Quarkus 3.27.1 dist/quarkus
fix#44438 Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients saml
fix#44480 Wrong persistent group permissions when multiple group membership changes happen in the same request core
security#44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation
fix#43323 Sessions not removed when user is deleted infinispan
fix#43738 UPDATE_EMAIL action invalidates old email login/ui
fix#43754 Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest ci
fix#43812 Admin console sends non-JSON payload with content-type: application/json admin/ui
fix#44125 Double-encoding of query parameter values (e.g. acr_values) for version 26.4 identity-brokering
fix#44187 [Keycloak Docs CI] Broken links docs
fix#44189 [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry infinispan
fix#44229 Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions infinispan
fix#44269 Admin Client creates malformed paths for requests admin/client-js
fix#44287 Caching of static theme resources in dev mode is disabled core
fix#42601 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP ci
fix#43212 Document missing artifact dependency for UserStoragePrivateUtil docs
fix#43564 Invalid liquibase check sum for jpa-changelog-2.5.0.xml core
fix#43718 Email Not Persisted During Registration When "Email as Username" is Enabled and User Edit Permission is Disabled user-profile
fix#43793 import does not seem to run db migration import-export
fix#43883 Creating group policy on a client uses "manage-clients" role if FGAP V1 is disabled authorization-services
fix#44010 Ordering attributes will unset the unmanaged attribute policy user-profile
fix#44031 Can't build keycloak 26.4.4 with quarkus.launch.rebuild=true dist/quarkus
fix#44056 Allow only normalized URLs in requests caused a regression in view authz permission details in Admin Consol admin/ui
fix#44117 DockerClientTest failure testsuite
securityFixes CVE-2025-11538: Debug default bind address
securityFixes CVE-2025-10939: Unable to restrict access to the admin console
feature#10388 Allow to hide client scopes from scopes_supported in discovery endpoint
feature#43076 Add rate limiter for sending verification emails in context of update email
feature#43509 Role authorization for workflows. admin/api
fix#41270 Cannot save new attribute group admin/ui
fix#41271 Changing user profile attribute results in an error everytime admin/ui
fix#43082 ExternalLinksTest is broken due to missing path parameters docs
fix#43091 Duplicate Email Fields on Temporarily Locked Out Sign In With Organization Identity-First Login login/ui
fix#43160 Regression in DEBUG_PORT handling since 26.4.0 – host binding (*:port / 0.0.0.0:port) no longer works dist/quarkus
fix#43460 FGAP/UI: `reset-password` succeeds but UI shows 403 without Users:manage admin/fine-grained-permissions
fix#43505 DPoP proof replay check doesn't consider clock skew oidc
fix#43516 Deleting Client is slow and fails when a lot of client sessions exist core
fix#43578 "admin" client role now requires server admin user admin/api
fix#43579 403 Forbidden when assigning realm-management client roles with realm-admin despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions
fix#43596 FGAP: user can no longer open account management page, broken by `reset-password` admin/fine-grained-permissions
fix#43621 Version 26.4.1 breaks existing ldap users with capital letters in username ldap
fix#43682 When syncing roles, the database layer can see deadlocks
fix#43698 Role Mapper is updating the user every time on login identity-brokering
fix#43723 Only add the none verifier when attestation conveyance preference is none (or default) authentication/webauthn
fix#43734 Refresh token allowed for offline session even the related scope is removed
fix#43736 FGAP V2: reset-password scope error when viewing users with Group permissions only core
fix#43744 Increased memory usage due to leaking KeycloakSession instances admin/api
fix#43759 QuarkusKeycloakSession not garbage collected when running Liquibase dist/quarkus
fix#43761 QuarkusKeycloakSession kept in memory for each timer core
fix#43763 Normalizing of Keycloak URLs not documented dist/quarkus
fix#43774 Under OLMv1 service monitor check uses wrong namespace operator
fix#43785 QuarkusKeycloakSession leak in DeclarativeUserProfileProvider user-profile
fix#43853 Ensure the logout endpoint removes the authentication session oidc
fix#43863 JS CI failing after normalization testsuite
feature#42991 Final review and update for UPDATE_EMAIL documentation docs
feature#43351 Make pending email verification attribute removable by admin user-profile
feature#43650 SPIFFE should support OIDC JWK endpoint
fix#26374 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci
fix#30939 Vulnerability in brute force detection settings authentication
fix#43022 Incorrect Basic Auth encoding for OIDC IDentity Provider when Client ID contains colon identity-brokering
fix#43191 Upgrade guide for 26.4.0 should mention new minimal PostgreSQL server version 13 requirement docs
fix#43244 UI crash on admin `/users/add-user` since 26.4.0 admin/ui
fix#43544 Intra-document links not rendered in downstream docs
fix#43561 Server does not shutdown gracefully when started with --optimized core
securityFixes CVE-2025-11419: Keycloak TLS Client-Initiated Renegotiation Denial of Service
feature#43020 Secure Client-Initiated Renegotiation - disable by default dist/quarkus
feature#42990 Hide read-only email attribute in update profile context with update email enabled user-profile
feature#43357 JDBC_PING should publish its physical address on startup
fix#40965 Group permission denies to view user admin/fine-grained-permissions
fix#41292 openid-connect flow is missing response type on language change authentication
fix#42565 Standard Token Exchange: chain of exchanges eventually fails token-exchange
fix#42676 Security Defenses realm settings lost when switching between Headers and Brute Force Detection tabs (v25+) admin/ui
fix#42907 Race condition in authorization service leads to NullPointerException when evaluating permissions during concurrent resource deletion authorization-services
fix#43042 Avoid NPE in FederatedJWTClientAuthenticator when checking for supported assertion types core
fix#43070 Update email page with pending verification email messages prefilled with old email user-profile
fix#43096 keycloak-operator 26.4.0 missing clusterrole permissions docs
fix#43104 Release notes fix for update email docs
fix#43161 Restarting an user session broken for persistent sessions infinispan
fix#43164 Keycloak docs state that only TLSv1.3 is used docs
fix#43218 Cannot revoke access token generated by Standard Token Exchange oidc
fix#43254 Make sure username and email attributes are lower cased when fetching their values from LDAP object ldap
fix#43269 Keycloak 26.4 returns a different error response on a token request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc
fix#43270 Keycloak 26.4 returns a different error response on a CIBA backchannel authentication request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc
fix#43286 Broken links on DB server configuration guide docs
fix#43304 SAML Client - Encrypt assertions toggle shows wrong dialog text (Client signature required) saml
fix#43328 "Remember me" user sessions remain valid after "remember me" realm setting is disabled authentication
fix#43335 First JDBC_PING initialization happens in the JTA transaction context infinispan
fix#43349 Client session may be lost during session restart infinispan
fix#43394 SPIFFE client authentication does not work when JWT SVID includes `iss` claim
fix#43459 Invalid YAML in advanced Operator configurations docs
featurePasskeys for seamless, passwordless authentication of users.
featureFederated Client Authentication to use SPIFFE or Kubernetes service account tokens for client authentication.
featureSimplified deployments across multiple availability zones to boost availability.
featureFAPI 2 Final: Keycloak now supports the final specifications of FAPI 2.0 Security Profile and FAPI 2.0 Message Signing.
featureDPoP: The OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP) is now fully supported. Improvements include the ability to bind only refresh tokens for public clients, and securing all Keycloak endpoints with DPoP tokens.
securityPossibility to make only refresh tokens of a public client to be DPoP bound and omit the binding of an access token.
securityAll Keycloak endpoints that are secured by bearer token can now handle DPoP tokens. This includes, for example, the Admin REST API and Account REST API.
securityPossibility to require the dpop_jkt parameter in the OIDC authentication request.
featureEnterpriseDB (EDB) Advanced 17.6
featureAzure SQL Database and Azure SQL Managed Instance
feature#19732 "linked-accounts" endpoint displays all Identity providers account/api
feature#40237 Add option "Requires short state parameter" to OIDC IDP authentication
feature#40696 Wrap deprecated passkeys authenticator behind the feature authentication/webauthn
feature#41316 Test suites config for the new test framework test-framework
feature#41357 Disable tests for specific databases and servers in test framework test-framework
feature#42313 Experimental SPIFFE identity provider
feature#42742 Supported EnterpriseDB Advanced 17
feature#42743 Supported Azure SQL
feature#10063 Display transport media for WebAuthn authenticators in Account console account/ui
feature#14644 External IDP tokens are not refreshed automatically for OAuth2 & OIDC IDPs when retrieving the external token identity-brokering
feature#17028 SAML: Adapter SP seamless certificate rotation saml
feature#19213 Allow enabling debug and verbose via environment variables dist/quarkus
feature#21816 Expose Keycloak config errors in the Keycloak CR status field operator
feature#22730 REST API returns different amount of users admin/api
feature#23972 Improve handling config options in scripts preventing re-augmentation
feature#25668 Remove duplication of MP config initialization dist/quarkus
feature#26277 DPoP: Allow to only DPoP-bind refresh tokens and still issue access tokens of type Bearer oidc
feature#26995 Bad performance when requesting events of a user
feature#27025 Move import/export validation to the Property Mappers dist/quarkus
feature#28846 Allow the target attribute on in the kcSanitize core
feature#29295 Exact match in users/count
feature#30095 High Availability guides should make distinction between single-site and multi-site deployments docs
feature#31285 Make domains for organisations optional
feature#32129 Automatically create external caches for MULTI_SITE deployments
feature#32569 Verify email when using UPDATE_EMAIL action without depending on realm wide setting
feature#33942 Make sure Keycloak endpoints have DPoP validation oidc
feature#34114 Operator: Support ConfigMaps for `Keycloak.spec.truststores`
feature#34206 Move to single approach for setting `Robots` specifications: prefer `X-Robots-Tag` header to `` tags core
security#41184 CVE-2025-48924 - Uncontrolled Recursion vulnerability in Apache Commons Lang
security#41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core
+364 more items in the release notesfeature#41371 Upgrade to Quarkus 3.20.3 LTS dist/quarkus
feature#41373 Remove explicit MariaDB connector dependency dist/quarkus
fix#41418 Access to user details for restricted admin fails after enabling organizationin realm organizations
fix#42405 Old hmac-generated (32bit) is recreated when order is changed in realm keys ui core
security#42491 CVE-2025-58057 - Netty BrotliDecoder / Data Amplification vulnerability dist/quarkus
security#42492 CVE-2025-58056 - Netty HTTP Request Smuggling vulnerability dist/quarkus
fix#42736 Reset password in admin UI with 'not recently used' password policy leads to error 'Device already exists with the same name' core
fix#42769 Missing switch "ID Token as detached signature" in the admin console client settings oidc
fix#42922 Dynamic Client Registration invalidates the realm cache core
securityFixes CVE-2025-9162: Variable resolution on imports can expose environment variables
securityFixes CVE-2025-10044: Keycloak error_description injection on error pages that can trigger phishing attacks
feature#40630 Double check when working with multithreading. SAST
feature#42245 Upgrade to Quarkus 3.20.2.2
fix#35825 Per client session idle time capped by realm level client idle timeout core
fix#40374 Random but frequent duplicate key value violates unique constraint \"constraint_offl_us_ses_pk2\" errors authentication
fix#40463 Login to Account Console produces two consecutive LOGIN events account/ui
fix#40857 Unbounded login_hint Parameter Can Corrupt KC_RESTART Cookie and Break Login Flow oidc
fix#41427 Parallel token exchange fails if client session is expired token-exchange
fix#41801 Lack of coordination in database creation in 26.3.0 causes deployment failures (Reopen) core
fix#41942 Uncaught server error: org.keycloak.models.ModelException: Database operation failed : Sync LDAP Groups to Keycloak (Custom Provider) core
fix#42012 Client session timestamp not updated in the database if running multiple nodes infinispan
fix#42046 KeycloakRealmImport placeholder replacement provides access to sensitive environment variables. operator
fix#42158 Bug in configuration keycoak via keycloak.conf dist/quarkus
fix#42164 [Keycloak CI - Docs] Broken links core
fix#42178 Integer validation error not shown for user profile fields user-profile
fix#42182 Validation errors for required actions don't show translated messages admin/ui
fix#42270 Missing double-dash in the events documentation core
fix#42339 Allowed Client Scopes add openid scope in scope list oidc
fix#42369 Missing client session offline settings on realm level in the admin UI admin/ui
securityFixes CVE-2025-8419: Keycloak SMTP Inject Vulnerability
feature#41558 Ensure cache configuration has correct number of owners
feature#41934 Infinispan 15.0.19.Final
feature#41963 Upgrade to Quarkus 3.20.2.1 dist/quarkus
fix#39562 Breaking template change: Unknown `locale` input field added to user-profile registration page user-profile
fix#40984 Backchannel logout token with an unexpected signature algorithm key oidc
fix#41023 Can't send e-mails to international e-mail addresses: bad UTF-8 syntax core
fix#41098 Locked out after upgrade to 26.3.1 due to missing sub in lightweight access token core
fix#41268 `--optimized` flag and providers jar are incompatible when used with tools changing `last-modify-date` dist/quarkus
fix#41290 Concurrent starts with JDBC_PING lead to a split cluster infinispan
fix#41390 JDBC_PING2 doesn't merge split clusters after a while infinispan
fix#41421 Broken link securing-cache-communication in caching docs docs
fix#41423 Duplicate IDs in generated all configuration docs docs
fix#41469 Uncaught exception cases unclosed spans in tracing dist/quarkus
fix#41488 Synchronize Maven surefire plugin with Quarkus dist/quarkus
fix#41491 ExternalLinks are broken in documentation docs
fix#41520 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and KERBEROS_PRINCIPAL was null on creation ldap
fix#41532 LDAP Sync all users takes unexpectedly long in 26.3 (> 30 min) ldap
fix#41537 Getting error 405 "Method Not Allowed" when calling the "certs" endpoint with HEAD method oidc
fix#41643 Test SMTP connection fails when no port is specified admin/api
fix#41663 Typo in the caching doc docs
fix#41677 Provider default regression dist/quarkus
security#41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages core
fix#41842 memberOf attribute empty or values with a DN that does not match the role base DN fetches all roles ldap
fix#41906 Backwards incompatible changes to 26.3.0 cause NullPoointerException when requesting /certificates/jwt.credential/generate-and-download authentication
fix#41945 After upgrade to 26.3: Not possible to use Credentials having not-unique label login/ui
feature#40237 Add option "Requires short state parameter" to OIDC IDP authentication
feature#40970 Run clustering compatibility tests on release/x.y branches
feature#41034 Improve logging for client sessions load
feature#41257 Upgrade to Infinispan 15.0.18.Final infinispan
fix#39091 Flaky test: org.keycloak.testsuite.cluster.JGroupsCertificateRotationClusterTest#testCoordinatorHasScheduleTask ci
fix#39634 Update MariaDB connector to 3.5.3 dist/quarkus
fix#39854 Flaky test: org.keycloak.testsuite.cluster.PermissionTicketInvalidationClusterTest#crudWithFailover ci
security#40553 Upgrade org.postgresql:postgresql to version 42.7.7 to address CVE-2025-49146 dependencies
security#40736 CVE-2025-49574 - Exposure of Resource to Wrong Sphere vulnerability in io.vertx:vertx-core dependencies
fix#40782 Flaky test: org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithFailover ci
fix#40784 Default jdbc-ping cluster setup for distributed caches fails in Oracle infinispan
fix#40977 Loglevel recorded from build phase dist/quarkus
fix#40980 Can't update security-admin-console via admin UI with volatile sessions infinispan
fix#40995 LDAP / ModelException: At least one condition should be provided to OR query core
fix#41018 Flaky test: org.keycloak.testsuite.cluster.ClientInvalidationClusterTest#crudWithFailover ci
fix#41038 FIPS errors in CI
fix#41082 Multiple primary key defined when attempting to upgrade after 26.3.0 core
fix#41103 Service Account users now showing in the User List admin/ui
fix#41105 Unknown relation when removing realm role with --db-schema configured storage
fix#41152 Docs use em-dashes instead of double dashes for SPI options in regular text docs
fix#41204 UpdateTest CI failures ci
fix#41370 [26.3] MariaDB connector dependency is not properly overriden dist/quarkus
feature#40851 Upgrade to Infinispan 15.0.16.Final
feature#40962 Update limitations of the preview feature rolling updates for patch releases infinispan
fix#35932 Importing a realm takes more than 1 minute when multiple others exist. dist/quarkus
fix#40368 NPE during loading user groups with concurrent deletion storage
fix#40713 Unable to configure TLS reloading in Keycloak version 26.2.0 or later account/api
fix#40838 Mark options for additional datasources as preview dist/quarkus
fix#40890 Keycloak Operator 26.3.0 fails to update to 26.3.0 operator
fix#40930 Docs: server_development/topics/themes.adoc docs
fix#40954 Keycloak 26.3.0 Regression: Failed to login if web-authn is disabled core
securityFixes CVE-2025-7784: Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled)
featureAccount recovery with 2FA recovery codes, protecting users from lockout.
featureSimplified experiences for application developers with streamlined WebAuthn/Passkey registration and simplified account linking to identity providers via application initiated actions.
featureBroader connectivity with the ability to broker with any OAuth 2.0 compliant authorization server, and enhanced trusted email verification for OpenID Connect providers.
featureAsynchronous logging for higher throughput and lower latency, ensuring more efficient deployments.
featureFor administrators, experimental rolling updates for patch releases mean minimized downtime and smoother upgrades.
feature#21995 Configurable probes in the Operator operator
feature#29116 Add supported config options for additional datasources dist/quarkus
feature#29596 Passkeys conditional UI: integration with username/password form authentication/webauthn
feature#38465 Name for OTP device should be unique account/api
feature#38985 Possibility to log details and representation to the jboss-logging listener
feature#39408 make MaxAuthAge configurable for required actions authentication
feature#40021 Passkeys conditional UI: integration with independent username and password form authentication/webauthn
feature#40033 Deprecate or remove the current conditionalUI authenticator authentication/webauthn
feature#12025 Get multiple users by Ids admin/api
feature#21277 Support IPv6 only environments dist/quarkus
feature#23283 Allow Keycloak operator to parameterize the Service annotations and labels
feature#28713 Temporarily Locked out users change the enabled flag of the user account/api
feature#28851 Support Syslog async properties dist/quarkus
feature#30227 Admin-UI: move PKCE Code Challenge Method setting from Advanced to Settings tab
feature#33978 Migration progress missing
feature#34160 Remove CACHE_EMBEDDED_REMOTE_STORE Feature
feature#35446 Ensure Client Initiated Account Linking behaves like other Application Initiated Actions authentication
feature#36635 Change User details page drop-down filter to make it easier to find the 'admin' role admin/ui
feature#37532 Remove user event types from admin UI is unusable admin/ui
feature#37716 Add ability for Quick Theme to import theme from a jar admin/ui
feature#37717 Quick Theme should allow naming the jar before download admin/ui
feature#38091 Add more validation for proxy-headers
feature#38228 Auto submit the "Organization Identity-First Login" form with pre-filled username field organizations
feature#38259 Enhance mapping from env variables to wildcards
feature#38262 Add `count` endpoint for organizations organizations
feature#38433 Make `ThemeManagerFactory` into a proper SPI so that it can be accessed/overridden core
feature#38496 Create CacheRemoteConfigProvider
feature#38497 Create CacheEmbeddedConfigProvider
feature#38578 Support Asynchronous logging
feature#38614 Improve Dutch translation for Theme base/login and base/email translations
feature#38620 Key generation for client authentication is always RSA 2048 with a 10-year validity, regardless of the selected algorithm authentication
feature#38621 Client secret generation provides lower than expected entropy authentication
feature#38649 Improve migration performance core
security#39349 CVE-2025-3910 Two factor authentication bypass
+331 more items in the release notesfeature#39469 Fix Securing Apps links to adapters docs
feature#39486 Email server credentials can be harvested through host/port manipulation admin/api
feature#39541 Fix doc link to FGAP v1 docs
feature#39543 Apply edits to Operators Guide docs
feature#39572 Edit Observability Guide docs
feature#39590 Fix callouts in Operator guide docs
feature#39638 Sessions from Infinispan should be mapped lazily for the Admin UI
feature#39651 Speed up Infinispan list of all sessions be more eagerly remove old client sessions
feature#39665 When logging in, all client sessions are loaded which is slow oidc
fix#39130 Authorization Code Flow Fails Scope Validation After Credential Definition Migration to Realm Level oid4vc
fix#39157 [quarkus-next] TestEngine with ID 'junit-jupiter' failed to discover tests dist/quarkus
fix#39264 [OID4VCI] Documentation Errors docs
fix#39358 Aggregated policy: Cannot select policies that do not appear in the drop-down list admin/ui
fix#39450 quarkus runtime options are treated as buildtime options dist/quarkus
fix#39496 [26.2.3/26.1.5] Regression: empty ClientList in UI for Custom UserStorageProvider admin/ui
fix#39499 UI does not show user's attributes after reentering the Attributes TAB admin/ui
fix#39502 Refreshed tokens are not persisted for IDP token exchange token-exchange
fix#39509 UI does not show organization's attributes after reentering the Attributes TAB account/ui
fix#39538 Autocomplete in Mapper type of user federation broken admin/ui
fix#39540 Forms IT tests breaks with Chrome 136.0.7103.59 ci
fix#39612 Unable to change the OTP hash algorithm admin/ui
fix#39614 Keycloak not using custom Infinispan config infinispan
fix#39663 Duplicate validation message “Please specify username.” shown on login form login/ui
fix#39693 Clicking on the jump links removes the localization of the UI admin/ui
fix#39697 Authorization documentation shows the wrong view authorization-services
fix#39710 Recreate update is not scaling down the statefulset to zero operator
fix#39724 Hibernate LazyInitializationException when deleting client with CompositeRoles core
fix#39753 POST realm API returns 400 on conflict instead of 409 in version 26.2.4 admin/api
fix#39798 Documentation has outdated link to the "latest" branch of quickstarts docs
fix#39800 [KEYCLOAK CI] - AuroraDB IT - Create EC2 runner instance ci
feature#39418 Clarify when to use podman docs
fix#35278 Double click on social provider link causes page has expired error login/ui
fix#38918 IPv6 support: Broker tests failing with proxy configuration ci
fix#39021 After migrating to newer Keycloak, token refreshes using inherited offline sessions return access tokens with invalid exp value oidc
fix#39023 Keycloak 26.2.0 UI Performance Degradation admin/ui
fix#39173 duplicate key value violates unique constraint "constraint_offl_cl_ses_pk3" infinispan
fix#39454 JGroups errors when running a containerized Keycloak in Strict FIPS mode and with Istio infinispan
fix#39500 Update Job Pod is listed in the keycloak discovery service operator
feature#38985 Possibility to log details and representation to the jboss-logging listener
feature#39080 Standardize introductory text in Keycloak guides
fix#38104 Temporary failure in name resolution with nip.io ci
fix#38145 Unknown error on authentication-flow delete action admin/ui
fix#38482 SAML client certificate not persisted admin/ui
fix#38487 [Keycloak Operator CI] - Test remote (slow) - UpdateTest.testExplicitStrategy ci
fix#38660 Ldap federation seems to open and keep open a new thread/connection for each ldap request ldap
fix#38671 Duplicate Key Violation When Reauthenticating After Account Deletion via Google identity-brokering
fix#38703 Password Policy Changes get overwritten in the UI admin/ui
fix#38799 Kerberos principal attribute value "comes back" when cleared. admin/ui
fix#38873 Client Credentials tab : "Allow regex pattern comparison" toggle is always "On" on page load admin/ui
fix#38911 Filtering of user- and admin-events by dateTo always returns empty results admin/api
fix#38932 Home button always redirects to master realm when permission denied admin/ui
fix#38934 UI: Readonly/disabled profile form input fields are visually indistinguishable from active fields account/ui
fix#38964 [26.2.0/26.1.5] Regression: ClientList value is empty in UI for Custom UserStorageProviderFactory admin/ui
fix#38970 Authentication request can fail with `unknown_error` authentication
fix#39026 Fine-grained-permssion v2 Display problem admin/fine-grained-permissions
fix#39037 UserInfo request fails by using an access token obtained in Hybrid flow with offline_access scope oidc
fix#39046 Keycloak 26.2.0 can't authenticate to the H2 database after the upgrade core
fix#39055 After import of keys an export doesn't include these values admin/ui
fix#39065 Issue with SSL and `CertificatereloadManager` in Keycloak 26.2 when using Istio infinispan
fix#39085 Redirects to admin endpoint 404s on hostname-admin / request scheme mismatch core
fix#39124 [Operator CI] - Test remote (slow) ci
fix#39180 Groups view: Filter/search bar disappears and groups not shown after clearing empty search results admin/ui
fix#39182 Oracle driver problems in keycloak 26.2.1 dependencies
fix#39187 Account console: defaultLocale item in select locale field account/ui
fix#39206 Wrong UDP jgroups metric name docs
fix#39219 Serverinfo response grows over time admin/api
fix#39237 Deletion of a role is slow when when there are a lot of roles in the database core
fix#39246 Duplicate user entries when searching custom attributes core
fix#39274 Aurora DB should not update automatically to the latest minor version ci
fix#39296 Inconsistent "grant_types" vs "grantTypes" Naming Causes GrantTypeCondition to Always Fail core
fix#39312 SLO measurement should mention a month as a period docs
feature#39142 Make distribution startup timeout configurable testsuite
fix#39125 [Keycloak CI] - FIPS UT - Run crypto tests ci
security#39349 CVE-2025-3910 Two factor authentication bypass
security#39350 CVE-2025-3501 Keycloak hostname verification
feature#38956 Clarify upgrade instructions
feature#39057 Change the title for Grafana dashboards guide to plural docs
feature#39059 Document operator `Auto` update strategy when used with `podTemplate`
fix#38458 [FGAP] [UI] Permission search doesn't execute correct consequent search request admin/fine-grained-permissions
fix#38692 Test coverage for count menthods when filtering admin/fine-grained-permissions
fix#38767 Make group required when selecting a specific group creating a premission admin/ui
fix#38812 Test failures in CI in Chrome tests ci
fix#38846 StatefulSet reconciliation infinitely looping operator
fix#38913 [FGAP] AvailableRoleMappings do not consider all-clients permissions admin/fine-grained-permissions
fix#38920 Downstream docs have duplicate ID on sampling docs
fix#38925 Blocking issue with increasing JVM thread count after migrating from 26.0.8 to 26.1.4 infinispan
fix#38929 Permission details sometimes don't show the name of the client admin/fine-grained-permissions
fix#38930 [Docs] Broken link in ExternalLinksTest for importmap docs
fix#38937 Liquibase checksum mismatch when upgrading from Keycloak ≤ 22.0.4 directly to 26.2.x storage
fix#38982 JpaRealmProvider getGroupByName return group duplicate due to change of comparison (like vs equal) ldap
fix#39015 Keycloak operator with update strategy to Auto: missing imagePullSecrets operator
fix#39096 Release note 26.2.0 has broken link docs
featureCentralized Admin Console Management - New Permissions section was introduced to allow management from a single place without having to navigate to different places in the Admin Console.
featureImproved manageability - Administrators can more easily search and evaluate permissions when building a permission model for realm resources.
featureResource-Specific and Global Permissions – Permissions can be defined for individual resources (such as specific users or groups), or entire resource types (such as all users or all groups).
featureExplicit Operation Scoping – Permissions are now independent, removing hidden dependencies between operations. Administrators must assign each scope explicitly, making it easier to see what is granted without needing prior knowledge of implicit relationships.
featurePer-Realm Enablement – Fine-Grained Admin Permissions can be enabled on a per-realm basis, allowing greater control over adoption and configuration.
featureKeycloak troubleshooting dashboard - showing metrics related to service level indicators and troubleshooting.
featureKeycloak capacity planning dashboard - showing metrics related to estimating the load handled by Keycloak.
feature#10438 Release process for OperatorHub operator
feature#17171 Traefik SPI Provider
feature#35507 Token exchange - permissions token-exchange
feature#36306 New CLI command: update-compatibility
feature#36520 New operator spec: upgrade strategy
feature#36696 Support token type "at+jwt" for OAuth 2 access tokens oidc
feature#36750 Create CA certificate for JGroups encryption
feature#38523 Expose OTP Policy in FreeMarker Context for Login Themes login/ui
feature#17432 Add support for SMTP OAuth 2.0 authentication for outgoing email core
feature#19127 Improve docs about audience docs
feature#19148 Token Exchange in "Securing Applications and Services" should mention admin_fine_grained_authz token-exchange
feature#21728 Removal of X-XSS-Protection header core
feature#23144 Review and document how refresh tokens are issued when executing token exchanges token-exchange
feature#24297 Add authentication flow mapping to existing ACR implementation authentication
feature#25154 `VERIFY_EMAIL` is not supported as an Application Initiated Action
feature#26473 The way CRLs are currently loaded is slow and uses large amounts of memory authentication
feature#27734 Use separate OLM channels for each major Keycloak release operator
feature#28569 Ability to set DN for new users/groups seperate to DN used for search
feature#30226 Admin-UI: disable Direct Access Grant by default when creating a new client
feature#31797 Improved consent handling in token exchange (OIDC to OIDC Client) token-exchange
feature#33357 Create some mechanism to catch duplicate keys in .properties file translations
feature#33804 Support multiple mail domains for linked IDPs per organization organizations
feature#33833 Replace `RTL_LANGUAGE_CODE` with Intl request
feature#33946 Keycloak Admin Client: Close Session when Client is Closed
feature#34132 Signed SAML metadata saml
feature#34202 Improve useability of authentication flow UI admin/ui
feature#34275 Organizations: Allow Organization Selection organizations
feature#34343 CreatedResponseUtil.getCreatedId should expose the actual error message from the server admin/client-java
feature#34720 Include broker session ID in IDENTITY_PROVIDER_LOGIN events
feature#34764 Do not remove users in LDAP when queries return an empty result ldap
security#36195 CVE-2024-12397 - HTTP Request Smuggling in io.quarkus.http:quarkus-http-core dist/quarkus
security#36965 CVE-2025-0736 Error during JGroups channel creation may reveal secure information
security#37360 CVE-2024-47072 - XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
+330 more items in the release notesfeature#38409 Upgrade to Quarkus 3.15.4 dist/quarkus
feature#38764 OTel: Unable to disable sampling at runtime; tracing-sampler-ratio validation prevents setting 0.0 dist/quarkus
fix#36482 The root cause of error is suppressed in KC 26 at building dependencies
fix#37792 Save Button Not Enabled When Switching OTP Type from "Time Based" to "Counter Based" admin/ui
fix#37869 ConditionalOtpFormAuthenticator fails to set CONFIGURE_TOTP required action for LDAP read-only users
fix#38041 [Keycloak CI] - WebAuthn tests ci
fix#38063 Issue in clearing offline sessions internally using ClearExpiredUserSessions Scheduled task
fix#38152 Broken guides link on reverseproxy page docs
fix#38353 Keycloak email message ID contains the local host name or IP address core
fix#38454 Keycloak account console is missing the Keycloak logo account/ui
fix#38576 Define a max expiration window for Signed JWT client authentication oidc
fix#38607 Recaptcha secret key configuration lost when migrating from 24.0.5 to 26.1.4 authentication
fix#38740 OTelHttpClientFactory not configured properly when tracing enabled dist/quarkus
feature#37433 Allow admin to disable automatic refresh of event views admin/ui
feature#37711 Upgrade to Infinispan 15.0.14
fix#37320 Cannot fetch realm role that was renamed admin/api
fix#37621 When calling the token revoke endpoint multiple times with the same token, a database REVOKED-TOKEN constraint error is reported storage
fix#37843 Admin events: resource type filter does not work admin/ui
fix#37911 Unwanted placeholder texts in user profile fields admin/ui
fix#37944 KC_HTTPS_TRUST_STORE_TYPE not working dist/quarkus
fix#38038 The default setting of the client request object parameter is empty admin/ui
securityFixes CVE-2025-1391: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
securityFixes CVE-2025-0604: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
fix#32535 Invalid migration export for empty database core
fix#36405 Redirect after linking account account/ui
fix#36527 Viewing user events requires `view-realm`-role admin/ui
fix#36585 Keycloak user attribute key broken in Keycloak 26.1.0 admin/ui
fix#36703 When linking IDP to an organization hide on login sets as off admin/ui
fix#36709 SAML2 Client Signing Keys Config does not accept PEM import admin/ui
fix#36842 Comboxes do not display selected option after reset admin/ui
fix#36927 MeterFilter is configured after a Meter has been registered dist/quarkus
security#36965 CVE-2025-0736 Error during JGroups channel creation may reveal secure information
fix#36985 Admin console: unable to edit user profile attribute either on the form or the JSON editor. admin/ui
fix#37029 CI fails with "Problem creating zip: Execution exception: Java heap space" ci
fix#37066 Error on import of a public key (pem) authentication
fix#37128 Customized quarkus.properties for MySQL cause "Unable to find the JDBC driver (org.h2.Driver)"，The server fails to start. storage
fix#37169 Wrong organization claim assignment in JWT access token organizations
fix#37207 Change default value for force-login option in reset-credential-email authentication
fix#37229 Login form can be used to determine which email addresses / usernames are in the system login/ui
fix#37268 Problems changing pre-defined user profile attributes admin/ui
fix#37285 Upgrade to latest JGroups patch version
security#37360 CVE-2024-47072 - XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
fix#37431 Password policies like NoUsername consider case-sensitivity authentication
fix#37434 External Link Test failing docs
fix#37577 Property Name Casing Mismatch in ProtocolMapperUtils saml
deprecated#525 Drop support for end-of-life versions of Node.js
feature#573 Convert tests to standard modules to upgrade dependencies
feature#576 Upgrade `@keycloak/keycloak-admin-client` to latest version dependencies
fix#567 Connections with an error code are not terminated
fix#571 CI status badge in README is incorrect
fix#36858 JDBC Ping with Docker infinispan
fix#36919 Latency issue after Keycloak version upgrade core
fix#36926 Invoking dynamic client registration with lightweight access token results in a 404 oidc
fix#37162 Pods become unresponsive after upgrade to 26.1.0 infinispan
feature#552 Clean up old release code from Node.js adapter repo
feature#34275 Organizations: Allow Organization Selection organizations
feature#34343 CreatedResponseUtil.getCreatedId should expose the actual error message from the server admin/client-java
feature#36440 Remove Node.js adapter documentation from main repo docs
feature#36456 Clarify IPv6 JGroups requirements in Keycloak documenation
feature#36798 Add detail on dependencyManagement section for POM files
fix#558 The draft nightly untagged release is created by "Release nightly" GH action
fix#562 Incorrectly resolved {project_versionNpm} expression in the documentation
fix#32766 Translation error in messages_fr.properties translations
fix#33477 LDAP groups not showing members in Groups when using memberOf attribute ldap
fix#36159 Realm not found while exists and works if entered directly in the URL admin/ui
fix#36460 Deployment artifacts for Quarkus extensions are not in deployment dir dist/quarkus
fix#36483 Wrong link for tracing in 26.1.0 release notes docs
fix#36514 The organization claim does not appear if the Organization Membership Mapper is added through a custom client scope organizations
fix#36531 WebAuthN and dark mode: device icons are hardly readable login/ui
fix#36559 keycloak.v2 forms are too small for mobile view login/ui
fix#36629 All IDPs shown when reloading login page login/ui
fix#36649 When organizations feature is turned on, login_hint doesn't prefill identity-first login's page email field organizations
fix#36669 --spi-connections-liquibase-default-index-creation-threshold does not work core
fix#36675 Links error for https://jwt.io in documentation docs
fix#36728 Logging errors on DB transaction retries core
fix#36745 Conflict when Keycloak uses an OpenShift cluster ingress certificate operator
fix#36781 Flaky test: org.keycloak.testsuite.webauthn.account.WebAuthnTransportLocaleTest#localizationTransportInternal ci
fix#36782 Flaky test: org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#multipleSecurityKeys ci
fix#36844 Provide an option to force login after reset credentials authentication
fix#36887 Outdated documentation about how to use reCAPTCHA in development with localhost docs
fix#36902 Flaky test: org.keycloak.testsuite.webauthn.account.WebAuthnErrorTest#errorPageWithTimeout ci
fix#36945 Bad escape apostrophe character in messages_fr.properties login/ui
fix#36988 Typos in English email message templates translations
fix#36998 UI tests failing admin/ui
featureConfiguration via Keycloak CR in Keycloak Operator
featureCustom spans for:
featureIncoming/outgoing HTTP requests including Identity Providers brokerage
featureDatabase operations and connections
featureLDAP requests
featureTime-consuming operations (passwords hashing, persistent sessions operations, …)
feature#24992 Allow more extensive Override of BackchannelAuthenticationCallbackEndpoint core
feature#25006 Use optional realm attribute for authenticationrequest parameter max size/number validation configuration
feature#26178 Support dark mode, at least for the login pages login/ui
feature#26466 Operator support for setting default value of `http-pool-max-threads` operator
feature#27736 Used encrypted JGroups connection by default in Operator deployments operator
feature#29399 JDBC_PING2 as default discovery protocol
feature#32135 Option to specify trusted proxies dist/quarkus
feature#32488 Enabling authorization_details for client grant tokens until RAR is fully implemented
feature#33043 Provide missing user event metrics from aerogear/keycloak-metrics-spi to a keycloak mircometer event listener
feature#34957 Ability to specify log category levels through separate options dist/quarkus
feature#35110 Enhance WebAuthn registration to support custom FIDO2 origin validation
feature#35231 Ability to reject authentication to users without 2FA configured authentication
feature#35639 Allow users to specify the start page of a custom account-console theme account/ui
feature#36081 Authentication flow condition for client scope authentication
feature#10138 Align admin console for client for backchannel and frontchannel logout oidc
feature#10701 AuthenticationRequest add "create" prompt for sign-up oidc
feature#13852 js adapter just sets error to true upon error updateToken adapter/javascript
feature#16545 Additional authorization request parameters shouldn't be limited to 5 and shouldn't be discarded silently oidc
feature#16884 Support to enforce LoA in authentication flow for a client (Step-up) authentication
feature#17014 Allow custom message for brute force temporary lockout authentication
feature#23805 H2 Database should be opt-in and well-documented storage
feature#23881 Prevent "lost replace" in InfinispanAuthenticationSessionProvider storage
feature#26780 Maximum 100 resources with same URI checked when requesting permissions by URI authorization-services
feature#29511 Allow to restrict ProviderConfigProperty input to int values
feature#29570 Generalize or remove stack trace information found in error message exception handling
security#33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus
security#34794 CVE-2024-10973 - Cleartext Transmission of Sensitive Information in org.keycloak:keycloak-quarkus-server
security#35213 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process
security#35214 CVE-2024-10270 Potential Denial of Service
security#35215 CVE-2024-10492 Keycloak path trasversal
security#35216 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
security#35217 CVE-2024-10039 Bypassing mTLS validation
security#36394 CVE-2024-11736 Unrestricted admin use of system and environment variables
security#36395 CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers
+458 more items in the release notesfeature#33569 Show User Events on dedicated tab on Client-/User-Details
feature#34091 Username Form should support autocomplete login/ui
fix#34072 The Realm Selection Dropdown Breaks After 50 Realms In Database admin/ui
fix#34207 logout with client_id and/or post_logout_redirect_uri results in bad request on logout confirmation page oidc
fix#34402 [Keycloak 26.0.2] Getting "Forbidden, permission needed: query-clients" as temp-admin admin/ui
fix#34675 Keys tab showing disabled and inactive keys as active admin/ui
fix#34995 MySQL database migration issue core
fix#35048 Filter events by user id and client not working admin/ui
fix#35052 `organizationEnabled` and `verifiableCredentialsEnabled` attributes are present as attributes in an export
fix#35273 Edit Help Mode descriptor for Roles in policy form admin/ui
fix#35290 Database migration fails after upgrading operator to v26.0.6 core
fix#35317 Token issuer is null in executeActionsEmail and sendVerifyEmail if no clientId is passed admin/api
fix#35324 Strange Random behavior - Intermittent missing organization claim in Keycloak JWT token organizations
fix#35410 SAML Adapter Galleon Pack for EAP8 cannot use new metadata options for layers adapter/saml
fix#35416 Mis-formatted definition list of hashing algorithms
fix#35421 Showing LDAP error message when failing to reset password ldap
fix#35475 Delete user confirm title is wrong admin/ui
fix#35481 Events: Wrong text for user id search admin/ui
fix#35488 [Jekins Keycloak CI] - RH-SSO EAP adapters remote saml tests ci
fix#35526 Initial keycloak bootstrap suggestion is not correct. dist/quarkus
fix#35544 Upgrading guide 26.0.6 is missing in the built document docs
fix#35634 Temporary password toggle in set password dialog is cut off in admin-console admin/ui
fix#35675 New install doesn't allow admin user creation dist/quarkus
fix#35822 Exact searches should be the default when querying user by attributes admin/api
security#36394 CVE-2024-11736 Unrestricted admin use of system and environment variables
security#36395 CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers
feature#34882 Edits to Authorization Services guide
feature#34916 Addresse QE comments on Server Administration guide
feature#34931 Upgrade to ISPN 15.0.11.Final
fix#10233 Locale Setting for Update Password Mail admin/api
fix#17233 the InfoPage after an ExecuteActionsEmail is not localized based on the user's locale authentication
fix#30631 Upgrade to 25 throws: Statement violates GTID consistency core
fix#32143 UserId too long to add Security Key WebauthN authentication/webauthn
fix#32648 RP-Initiated logout using `POST` method fails in cross-origin setup oidc
fix#32676 Flaky test: org.keycloak.testsuite.forms.BrowserButtonsTest#appInitiatedRegistrationWithBackButton ci
fix#33071 RESTART_AUTHENTICATION_ERROR in Iphone devices (using safari and chrome browser) oidc
fix#33195 Any one Client role mapping to user/group generating two events on admin events tab. core
fix#33810 Stabilise my-resources.spec test account/ui
fix#34233 Service accounts visible under user search in Admin console admin/api
fix#34391 Error on "check a11y" tests on Cypress admin/ui
fix#34560 Switching 'Email as Username' alters existing custom usernames to email addresses, causing LDAP sync issues core
fix#34572 Text in "Choose a policy type" is not wrapping admin/ui
fix#34590 Attributes missing in OrganizationRepresentation when using Admin REST API in Keycloak 26 admin/api
fix#34678 [Admin UI] [Create resource-based permission] Resource input is disabled admin/ui
fix#34858 Deprecated CLI options and new options are not stable in their sorting dist/quarkus
fix#34864 On logout from admin console, a serverinfo call with 401 response in the logs admin/ui
fix#34888 Authentication Link and IDP Fails with 400 Bad Request After Migrating to Version 26 and Delete Authentification authentication
fix#34899 Upgrade 24 to 25 fails because db jpa changes drop nonexisting indexes. core
fix#34930 Update Email doesn't update username when Email as Username and Attributes are enabled user-profile
fix#34944 Adding "sub" claim to lightweight access token causes HTTP 403 Forbidden Error in Keycloak 26.0.5 oidc
fix#34975 getAll() organization members only returns the first 10 members organizations
fix#34987 KC25 Migration guide for caching options needs clarification
fix#35006 Mis-formatted unordered list in the caching docs
fix#35015 Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsRemoval ci
fix#35087 Flaky test: org.keycloak.testsuite.model.session.AuthenticationSessionTest#testConcurrentAuthenticationSessionsCreation ci
fix#35229 Fix typo in v24 changelog: "longer" -> "no longer" docs
fix#35232 reCAPTCHA v3 not working login/ui
fix#35276 Your login attempt timed out authentication
fix#35282 [Keycloak CI] - Test PoC failing on Keycloak 26.0 branch
fix#35288 Upgrade 26.0.5 -> 26.0.6 completely breaks admin events in the admin UI admin/ui
fix#35328 Error when creating a permission ticket when there are 2 or more Keycloak servers in a cluster authorization-services
securityFixes CVE-2024-10973: CLI option for encrypted JGroups ignored
feature#34315 Update the Keycloak CPU and Memory sizing guide to reflect the new ec2 workder nodes
feature#34386 Some dynamic imported functions are also statically imported making bundling them in-efficient
feature#34570 Make documentation more clear that keycloak javascript adapter and node.js adapter are OIDC docs
feature#34855 Add conditional text to Installation Locations
feature#34873 Update Leveraging JaKarta EE in Server Development guide
feature#34887 Apply QE edits to High Availability guide
fix#609 Workflow failure - Jakarta - SAMLServiceProviderTest.testAccessAccountManagement
fix#11008 Incorrect get the members of a group imported from LDAP ldap
fix#17593 Incorrect ldap-group-mapper chosen to sync changes to ActiveDirectory when several mappers with varying group paths used ldap
fix#19652 Members are inhereted from LDAP group with the same name ldap
fix#23732 JavascriptAdapterTest errors when running with strict cookies on Firefox ci
fix#27856 Social login - Stack Overflow test fails ci
fix#31456 Enabling/Disabling user does not work with Microsoft AD LDAP via Admin API/UI ldap
fix#32786 Organization Domain not marked as a required field in the Admin UI admin/ui
fix#33531 Previously entered translations should persist in the translation dialog for the attribute groups admin/ui
fix#34013 Add More Info to Organization Events organizations
fix#34065 Users without `view-realm` can't see user lockout state in Admin UI admin/ui
fix#34201 OIDC IdP Unable to validate signatures using validatingPublicKey certificate admin/ui
fix#34335 NPE in Organization(s)Resource when using Quarkus Rest Client admin/api
fix#34401 Incorrect Content-Type Expectation for POST /admin/realms/{realm}/organizations/{id}/members in Keycloak API admin/api
fix#34465 Missing help icons in Webauthn Policy and Webauthn Passwordless Policy missing in admin ui admin/ui
fix#34519 Clicking on link to Keycloak documentation from Keycloak admin UI does nothing instead of opening documentation admin/ui
fix#34549 Quarkus dev mode does not work dist/quarkus
fix#34572 Text in "Choose a policy type" is not wrapping admin/ui
fix#34603 NPE in InfinispanOrganizationProvider if userCache is disabled infinispan
fix#34624 Securing apps guide breaks downstream docs
fix#34634 Missing downstream explicit name for anchors docs
fix#34644 KC_CACHE_EMBEDDED_MTLS_ENABLED is ignored infinispan
fix#34671 `ClientConnection.getRemoteAddr` can return a hostname when behind a reverse proxy core
fix#34687 New credential templates broken in KC26 login/ui
fix#34905 [Keycloak CI] Outdated surefire artifacts names - Quarkus IT and UT ci
security#35213 CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process
security#35214 CVE-2024-10270 Potential Denial of Service
security#35215 CVE-2024-10492 Keycloak path trasversal
security#35216 CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
security#35217 CVE-2024-10039 Bypassing mTLS validation
fix#31415 Selection list does not close after outside click admin/ui
fix#33607 Fix v2 login layout login/ui
fix#33618 No message for `policyGroupsHelp` admin/ui
fix#33640 Customizable footer (Keycloak 26) not displaying in keycloak.v2 login theme login/ui
fix#34301 Remove inaccurate statement about master realm imports docs
fix#34450 [26.0.2] Migration from 25.0.1 Identity Provider Errors identity-brokering
fix#34467 Do not rely on the `pwdLastSet` attribute when updating AD entries ldap
feature#34284 Keycloak-admin-client should work with the future versions of Keycloak server admin/client-java
feature#34382 Make the organization chapter of Server Admin guide available on downstream
fix#14562 Broken Promise implementation for AuthZ JS adapter/javascript
fix#25917 Allow increasing wait time on each failure after the max number of failures is reached authentication
fix#33627 ClassNotFoundException OracleXADataSource/OracleDataSource using IDELauncher with Keycloak 26.0.0 dist/quarkus
fix#33731 Client Scope updates are not replicated on a distributed keycloak setup in kubernetes admin/api
security#33798 CVE-2021-44549 - org.eclipse.angus/angus-mail: Enabling Secure Server Identity Checks for Safer SMTPS Communication dist/quarkus
fix#33987 keycloak.v2 registration: Password policy validation error "errorList is null" login/ui
fix#34042 LDAP Pagination not working for role membership in GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE strategy ldap
fix#34050 Listing federated LDAP users is very slow with import enabled ldap
fix#34093 java.util.ConcurrentModificationException when process user sessions update infinispan
fix#34412 LDAP: searching users with import disabled is slower since fix for 34050 ldap
feature#32110 [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus
fix#15635 oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript
fix#19101 Uncaught (in promise): QuotaExceededError adapter/javascript
fix#20287 When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript
fix#28978 some GUI validation check missing admin/ui
fix#30832 Organization API not available from OpenAPI documentation admin/api
fix#31724 Logout not working after removing Identity Provider of user identity-brokering
fix#33072 Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn
fix#33844 Wrong documentation link in keycloak-js readme docs
fix#33902 Not persisted config settings prevent server start dist/quarkus
fix#33948 [PERF] OpenTelemetry is initialized even when disabled
fix#33968 Not possible to close dialog boxes when clicking buttons or the close icon admin/ui
fix#33991 Doc CI - broken links error docs
fix#34009 grammatical error in "Managing Organizations" documentation docs
fix#34015 Home URL for security-admin-console is broken admin/ui
fix#34028 Custom keycloak login theme styles.css return error 404 login/ui
fix#34049 Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations
fix#34063 Respect the locale set to a user when redering verify email pages user-profile
fix#34069 Do not show domain match message in the identity-first login when no login hint is provided organizations
fix#34075 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci
fix#34095 Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export
fix#34151 JS password validation doesn't work as intended with uppercase and lowercase minimum requirements login/ui
fix#34155 cli options starting or ending with ; or containing ;; mangle the cli handling dist/quarkus
fix#34224 Deleting a user leads to ISPN marshalling exception
feature#32152 Clarify the behaviour of multiple Operator versions installed in the same cluster operator
feature#33275 Better logging when error happens during transaction commit storage
fix#8935 keycloak.js example from the documentation leads to error path adapter/javascript
fix#19358 Issue with concurrent user & group delete, unable to cleanup resource server user-policy & group-policy authorization-services
fix#31848 Repeated email verifications while logging in through IDP caused by email case sensitivity authentication
fix#32266 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and user already exists ldap
fix#32617 Nightly Cypress tests for the Admin Console are failing on Firefox admin/ui
fix#32844 Login V2: Missing "dir" attributes login/ui
fix#32847 Admin UI defaults to master realm even without permissions to it admin/ui
fix#32962 Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm oidc
fix#33513 Can get authorization code on a non verified user with some specific kc_action (AIA) oidc
fix#33539 Keycloak In Docker: ERROR: Strict hostname resolution configured but no hostname setting provided docs
fix#33549 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci
fix#33557 Unable to submit forms in Safari account/ui
fix#33576 Broken links / anchors after KC26 release docs
fix#33578 In imported realms, the ability to use environment variables has disappeared import-export
fix#33585 Fix runaway asterisk formatting in TLS documentation docs
fix#33638 Non-optimized start command gives erroneous warnings for runtime spi options dist/quarkus
fix#33642 RTL not working on keycloak.v2 login template login/ui
fix#33645 keycloak-js register broken: createRegisterUrl not awaited adapter/javascript
fix#33699 Failure to redirect to organization IdP when the organization scope is included organizations
fix#33735 Organizations section is shown in account console if organizations is not enabled for a realm. account/ui
fix#33776 [Regression] 26.0.0 return empty "access: []" JWT for Docker-v2 Auth provider, resulting in "access denied" authentication
fix#33777 Error when adding or removing a user from an organisation when there are 2 or more Keycloak servers in a cluster organizations
fix#33780 Upgrade to 26 fails with 'ERROR: index "idx_us_sess_id_on_cl_sess" does not exist' core
fix#33814 NPE when device representation cannot be parsed authentication
fix#33817 NEP when Default Role is not present on CachedRealm infinispan
fix#33874 [Keycloak CI] - AuroraDB IT - Error creating EC2 runner instance
fix#33875 [Keycloak CI] - FIPS IT - Failed to fetch maven
fix#33883 Auth not possible for auth session where user was enabled in the meantime authentication
fix#33907 NPE thrown in whoami endpoint admin/ui
fix#33967 password is a required field admin/ui
featureJava admin client - Maven artifact org.keycloak:keycloak-admin-client
featureJava authorization client - Maven artifact org.keycloak:keycloak-authz-client
featureJava policy enforcer - Maven artifact org.keycloak:keycloak-policy-enforcer
featureKeycloak deployments are now able to handle user requests simultaneously in both sites.
featureActive monitoring of the connectivity between the sites is now required to update the replication between the sites in case of a failure.
featureThe loadbalancer blueprint has been updated to use the AWS Global Accelerator as this avoids prolonged fail-over times caused by DNS caching by clients.
featurePersistent user sessions are now a requirement of the architecture. Consequently, user sessions will be kept on Keycloak or Infinispan upgrades.
deprecated#600 De-couple quickstarts from statically served Keycloak JS quickstarts
feature#20342 Duplicate groups in the admin console of Keycloak admin/ui
feature#26178 Support dark mode, at least for the login pages login/ui
feature#29324 Bootstrapping an admin user using a dedicated command dist/quarkus
feature#29755 Support AES and HMAC Key-Imports for the JavaKeystoreKeyProvider
feature#30002 Bootstrapping an admin service account using a dedicated command dist/quarkus
feature#30009 Warnings for temporary admin user and service account core
feature#30011 Document admin bootstrapping and recovery docs
feature#30682 Group assignment: Display disabled information from user admin/ui
feature#30795 Initiate create events if ClientScopes are created
feature#31421 Add Events for Organization Creation and Member Assignment organizations
feature#31642 Include organization attributes and information in ID and access tokens organizations
feature#31643 Implement invitation-only self-registration for realm users organizations
feature#32030 Retry remote cache operations with back off
feature#32135 Option to specify trusted proxies dist/quarkus
feature#32553 Expose Password Policies in FreeMarker Context for Login Themes
feature#583 Update dependency on keycloak-client in main branch to 999.0.0-SNAPSHOT quickstarts
feature#10114 Specific events for webauthn register authentication/webauthn
feature#10492 Support proxy_protocol
feature#14073 SAML 2.0 HTTP-Artifact binding
feature#15769 update or replace base64-js and js-sha256 adapter/javascript
feature#16750 Google login - add prompt=select_account option core
feature#19564 response_type none is oidc spec but ignored in the current implementation. oidc
feature#19750 Use a proper FreeMarker template for the new consoles account/ui
feature#21072 Make sure identity providers are not send in realm GET requests and PUT requests used in "Realm settings"
feature#21261 Identity providers: Pagination in account console (and account REST API)
feature#21342 Upgrade login theme to PatternFly 5 login/ui
feature#23179 kcadm should have a command to verify connection admin/cli
feature#23596 Support generated ECDH realm keys oidc
security#32789 CVE-2024-7318 - Use of a Key Past its Expiration Date in org.keycloak:keycloak-core
security#33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
security#33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
security#33156 CVE-2024-7254 - Stack-based Buffer Overflow in com.google.protobuf:protobuf-java dist/quarkus
+528 more items in the release notesfix#30604 Network response was not OK. saml
fix#31165 Re-enabling a temporarily locked user (brute-force) deletes all user properties and attributes admin/ui
fix#32100 Remember Me with External Infinispan is not works properly infinispan
fix#32578 WebAuthn Flows Broken in login.v2 login/ui
fix#32643 Dots are not allowed in the path in Hostname v2 dist/quarkus
fix#32731 KeyCloak Admin Client uses non-standard `@NoCache` annotation which is an issue for Quarkus admin/client-java
fix#32799 Realm import fails when client configures default_acr values import-export
fix#32870 Increased DB activity due to changes in LDAPStorageManager.searchForUserByUserAttributeStream ldap
security#33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
security#33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
fix#32084 SAML adapter IdMapperUpdaterSessionListener not executed when session ID changes adapter/saml
security#32754 CVE-2024-7341 Session fixation in the SAML adapters adapter/saml
securityFixes CVE-2024-4629: Potential bypass of brute force protection
feature#31963 Upgrade to Infinispan 15.0.7.Final
fix#31299 NPM library of account-ui is unusable (@keycloak/keycloak-account-ui version 25.0.1) account/ui
fix#31304 Hide save / update buttons in account console for READ_ONLY federated accounts account/ui
fix#31340 Hidden options shown in help all dist/quarkus
fix#31386 Joining group for user doesn't list correct number of groups admin/ui
fix#31466 Duplicate Key "validatingX509CertsHelp" in admin-ui messages admin/ui
fix#31519 Admin API extremely slow with service account and fine-grained authorization `view-users` admin/fine-grained-permissions
fix#31545 Event tables have broken aria-labels admin/ui
fix#31558 MSSQL test container can't start ci
fix#31598 CURL commands in build don't check the response code ci
fix#31633 localization not work with user attribute display name in users add admin/ui
fix#31687 "Use metadata descriptor URL" switch is always set to "On" admin/ui
fix#31718 Documentation for `Delete Credential` action and related changes authentication
fix#31781 Keycloak 25 SAML IdP has made Single Logout URL mandatory. saml
fix#31835 Windows builds fail too often due to problems with the download of Node ci
fix#31918 Network error attempting to view events without permissions admin/ui
fix#31929 Network error attempting to view user registeration without permissions admin/ui
fix#32059 Look around window cannot be set to 0 admin/ui
fix#32127 Offline session bug on 25.0.2 core
fix#32150 Session list doesn't handle non-existing client gracefully core
fix#32178 Table names for persistent sessions upgrading guide is wrong docs
fix#32180 Session list not appearing: SQL Error "The incoming request has too many parameters"
fix#32195 Migration to persistent sessions fails from Keycloak version <22 storage
feature#30094 Do not inherit 'https-client-auth' property for the management interface
feature#30537 Document how Admin REST API endpoints work with Hostname config docs
feature#30856 Remove inclusive language foreword docs
fix#19070 authBaseUrl error on different hostname-admin-url, hostname-url admin/ui
fix#26042 Issue when start-dev in 23.0.1 dist/quarkus
fix#28489 Missing help text on tokens tab admin/ui
fix#29407 Need refresh attributes group translations on Users > Details tab admin/ui
fix#29566 User Profile attributes/groups in Admin UI are not translated using Localization for non-master realm when signed in the master realm account/ui
fix#29761 bug: disabling all default features no longer works core
fix#29784 Exception while trying to run a LDAP sync with a group importer and a batch size less then the actual number of groups ldap
fix#30329 Client secret rotation UI shows wrong rotated secret admin/ui
fix#30355 New operator failing on health checks operator
fix#30383 Account Console (v3) no longer highlights the current page in the nav bar account/ui
fix#30436 Client Roles are not shown when clientId property is set admin/ui
fix#30440 UI theme bug in KC 25.0.0 admin/ui
fix#30444 Failed to evaluate permissions when fetchRoles is enabled on role policies authorization-services
fix#30449 Migration stuck if versions incompatible operator
fix#30521 "Client Offline Session Max" no longer available admin/ui
fix#30541 Account UI resources try to load from admin path instead of frontend path account/ui
fix#30552 After migrating from 24 to 25, the signature algorithms names do not display in drop down menu admin/ui
fix#30591 Invalid character in spanish translation file for Identity Provider Link Template translations
fix#30652 Default server port is used instead of the management interface port in the guide about running Keycloak in a container
fix#30662 User policy -> select user shows user id instead of user name. admin/ui
fix#30712 Remove of Multivalued Attribute due to - Adding translations when a new attribute is created admin/ui
fix#30717 Broken external links docs
fix#30821 Testing connection to ldap on the settings page does not work in 25.0.1 ldap
fix#30837 Cannot find requested client with clientId ldap
fix#30866 admin-cli invalid credentials admin/cli
fix#30917 reCAPTCHA Enterprise v3 - Unrecognized field "accountDefenderAssessment" core
fix#30947 Error when trying to edit authentication sub-flow name / description admin/ui
fix#30992 Realm cannot be deleted if there are tons of consents storage
fix#31014 "Verify Email" may cause other Required Actions to be ignored authentication
fix#31050 Caching docs should name parameter runtime parameters, not build parameters docs
fix#31146 IDP SAML Certificate should be text-area not text admin/ui
fix#31167 After creating a new authentication flow and returning to the list, the "Used by" column displays "flow.undefined" admin/ui
fix#31171 Single use tokens, like action tokens, has a claim `expiration` core
fix#31187 Recaptcha links changed in the Google Docs docs
fix#31196 The check for userdn in test ldap should consider that AD proxy user can be in non DN format ldap
fix#31218 Clarify if JGroups thread metrics can be shown with embedded Infinispan
fix#31219 [Docs] Broken link in Server Admin guide for JWT_Auth wiki docs
+3 more items in the release notesfeature#19750 Use a proper FreeMarker template for the new consoles account/ui
feature#30346 Enhance masking around config-keystore dist/quarkus
fix#25234 front channel logout to clients are not called at Identity Proxy when using front channel logout to Identity Provider( oidc
fix#28643 Encountering `NullPointerException` - `KeycloakIdentity.getUserFromToken()` when running `admin-ui` locally admin/ui
fix#30115 Admin v2 theme - theme.properties Custom theme scripts not loading admin/ui
fix#30201 Keycloak CI - failure in Store IT (aurora-postgres) ci
fix#30240 Custom attributes are removed during UPDATE PROFILE event core
fix#30300 Upgrade to Keycloak 25 - Table 'USER_CONSENT' is specified twice on MySQL/MariaDB database core
fix#30302 Methods of SimpleHttp are after change now too much protected core
fix#30306 Upgrade to Keycloak 25 - Events bug in UI admin/ui
fix#30332 Operator fails to patch ingress after update to 25.0.0 operator
fix#30334 RESTART_AUTHENTICATION_ERROR when login in in private browser window after 25.0.0 update core
fix#30351 Migration of sessions in KC25 should run only on migration, not on imports
fix#30368 Documentation : label error for persistent-user-sessions feature flag docs
fix#30417 Keycloak 25 db guide shows unevaluated "ifeval docs
fix#30432 keycloak hostname:v2 /admin used on "hostname" instead of "hostname-admin" admin/ui
fix#30434 Improvements for ldap test authentication ldap
fix#30492 partial_import_test fails randomly admin/ui
featureKC_STATE_CHECKER now sets SameSite=Strict
featureKC_RESTART now sets SameSite=None
featureKEYCLOAK_LOCALE now sets SameSite=None
featureKEYCLOAK_REMEMBER_ME now sets SameSite=None
breakingServerCookie - replaced by NewCookie.Builder
breakingLocaleSelectorProvider.KEYCLOAK_LOCALE - replaced by CookieType.LOCALE
breakingHttpCookie - replaced by NewCookie.Builder
breakingHttpResponse.setCookieIfAbsent(HttpCookie cookie) - replaced by HttpResponse.setCookieIfAbsent(NewCookie cookie)
featureClaims sub and auth_time are added by protocol mappers now, which are configured by default on the new client scope basic, which is added automatically to all the clients. The claims are still added to the ID token and access token as before, but not to lightweight access token.
featureClaim nonce is added only to the ID token now. It is not added to a regular access token or lightweight access token. For backwards compatibility, you can add this claim to an access token by protocol mapper, which needs to be explicitly configured.
featureClaim session_state is not added to any token now. It is still possible to add it by protocol mapper if needed. There is still the other dedicated claim sid supported by the specification, which was available in previous versions as well and which has exactly the same value.
deprecatedAccessToken
deprecatedIDToken
deprecatedJsonWebToken
feature#25940 Support Credentials Issuance through the OID4VCI Protocol oid4vc
feature#25942 Issue Verifiable Credentials in the SD-JWT-VC format oid4vc
feature#25943 Issue Verifiable Credentials in the VCDM format oid4vc
feature#25945 Extend Account Console to support Credentials Issuance Self-Service account/ui
feature#26201 Introduce a new Authenticator to handle duplicate IdP broker links authentication
feature#27673 Hardcoded SAML metadata URL in admin-v2 admin/ui
feature#27728 Reflect new hostname v2 options in Keycloak CR operator
feature#27729 Add documentation for Hostname v2 docs
feature#27730 Release notes and Migration guide for Hostname v2 docs
feature#28030 Create Argon2 password hashing provider
feature#28400 Make RequiredActions configurable
feature#28608 Allow onboarding organization members through a registration invitation link
feature#28750 CLI options to disable encryption and authentication to external Infinispan dist/quarkus
feature#28938 Need inline translation assistance for user profile attribute groups.
feature#29491 Remove Oracle JDBC driver out of the box docs
feature#29539 Add CRUD for organizations to admin client
feature#29627 Expose Authorization Server Metadata Endpoint under /.well-known/oauth-authorization-server to comply with rfc8414 oid4vc
feature#29634 Expose JWT VC Issuer Metadata /.well-known/jwt-vc-issuer to comply with SD-JWT VC Specification oid4vc
feature#11757 Declarative User Profile: local-date validation and html5-date clash user-profile
feature#13113 Conditionally enable and disable CLI options dist/quarkus
feature#16295 JsonSerialization does not load all available modules from the classpath
feature#17530 Add Portuguese translations
feature#19334 Support management port for health and metrics in Quarkus 3 dist/quarkus
security#29607 CVE-2024-30172 - Infinite loop in org.bouncycastle:bcprov-jdk18on dependencies
security#29608 CVE-2024-30171 - Observable Discrepancy in org.bouncycastle:bcprov-jdk18on dependencies
security#29609 CVE-2024-29857 - Allocation of Resources Without Limits or Throttling in org.bouncycastle:bcprov-jdk18on dependencies
+474 more items in the release notessecurityFixes CVE-2024-3656: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities
securityFixes CVE-2024-4540: Exposure of sensitive information in Pushed Authorization Requests (PAR)
feature#29073 Use cache.compute() method to improve the replace retry loop
feature#29280 Update Create Realm in Keycloak 24 Getting Started
fix#29129 JGroups creates log messages as it switched internally to "trace" dist/quarkus
fix#29206 LDAP user creation reports error but user is created ldap
fix#29314 Clicking the "save" button multiple times in the Saml IDP configuration page corrupts the value of "AuthnContext ClassRefs" admin/ui
fix#29458 Empty CSP header value breaks security filter authentication
fix#29471 Cypress tests store videos even for passing tests ci
fix#29525 Maven clean build doesn't clean admin client generated files ci
fix#29554 Cypress failing on video recording ci
fix#29625 Database driver install examples can lead to permission errors in some circumstances docs
feature#27508 Use new remote-store options in HA guides
feature#28429 Add details to error messages, especially around refresh tokens
feature#28729 Emphasize the need for setting container limit docs
feature#28880 Upgrade to Quarkus 3.8.4 dist/quarkus
feature#29183 Minor corrections to High Availability Guide docs
fix#16345 Unable to delete realm names with invalid URL characters admin/api
fix#22617 kc export fails when using User Federation (LDAP) with file-based Vault enabled import-export
fix#24568 iframe for frontend logout gets blocked if a custom CSP header is used core
fix#24878 NoClassDefFoundError for Apache XML and EAP8 adapter/jee-saml
fix#27021 Workflow failure: Fuse adapter tests ci
fix#27080 Workflow failure: Operator CI - KeycloakTruststoresTests#testTrustroreExists ci
fix#27514 Uncaught server error: java.lang.IllegalArgumentException: Path parameter not provided oidc
fix#28079 Group search does not work in user view admin/ui
fix#28187 Admin UI drag & drop in flow config seems to delete actions admin/ui
fix#28220 Admin API: User PUT operation clears firstname, lastname email fields admin/api
fix#28303 WARN - Event object wasn't available in remote cache after event was received infinispan
fix#28377 Broken lists in import/export server guide docs
fix#28431 Dedicated client scopes always show up when searching admin/ui
fix#28514 Message for searchClientRegistration is missing admin/ui
fix#28666 Accessing a transient (lightweight) user through client session fails in admin-api/-ui admin/ui
fix#28684 "Extend to children" button in authorization group policies is wrongly disabled admin/ui
fix#28911 clients_saml_test.spec.ts fails in main admin/ui
fix#29072 Startup probe should check for existence of an Admin user before returning 200 dist/quarkus
fix#29094 Fix the client name help grammatical error admin/ui
fix#29133 DuplicateEmailValidator causes two DB queries on every login if a user has an email address core
fix#29147 local user login not possible after LDAP connection problem ldap
fix#29154 Update docs to distinguish between product names and CR names docs
fix#29233 Broken link in documentation docs
securityFixes CVE-2023-3597: Secondary factor bypass in step-up authentication
securityFixes CVE-2023-6544: Authorization Bypass
securityFixes CVE-2024-2419: Path traversal in the redirect validation
securityFixes CVE-2023-6717: XSS via assertion consumer service URL in SAML POST-binding flow
securityFixes CVE-2023-0657: Impersonation via logout token exchange
securityFixes CVE-2023-6787: Session hijacking via re-authentication
securityFixes CVE-2024-1132: Path transversal in redirection validation
securityFixes CVE-2024-1249: Unvalidated cross-origin messages in checkLoginIframe leads to DDoS
feature#26695 Keycloak and MSAD: enabling account in MSAD does not propagate to Keycloak ldap
fix#24201 Cannot disable LDAP-backed user if importEnabled=false ldap
fix#28100 Failed authentication: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.UserModel.getFederationLink()" because "this.delegate" is null identity-brokering
fix#28248 Update user makes User ID changes when federationLink and LDAP_ID is not set properly admin/api
fix#28335 The false option of the pkceMethod init parameter for the JavaScript adapter is ignored adapter/javascript
fix#28638 Missing permission to read configmaps in `keycloak-operator-role` operator
feature#25057 Inconsistent behaviour on getting user permissions using authorization authorization-services
feature#27433 Clarify format of keys in `additionalOptions` field in the Keycloak CR docs
feature#27481 Edit High Availability guide
feature#27484 Edit 23.0 changes part of Upgrading Guide
feature#27632 Integrate downstream Upgrading Guide changes into upstream
feature#27696 Upgrade to Quarkus 3.8.2 dist/quarkus
feature#27867 Corrections to Securing Apps Guide
feature#27871 Upgrade to Infinispan 14.0.26 core
feature#27953 Address feedback to Keycloak Server guide docs
feature#27955 Address term Keycloak in Server Administration Guide docs
feature#28009 Address edits to the Operator Guide
feature#28033 Upgrade Infinispan to 14.0.27.Final
feature#28084 Upgrade to Quarkus 3.8.3 dist/quarkus
fix#14501 Getting failed to initialize js message if consent is rejected by user account/ui
fix#15403 No email send on TOTP/Authenticator app removal core
fix#20637 Reset password flow fails with "Page has expired" error when Kerberos authentication is enabled in the browser flow authentication
fix#22644 Flaky test: org.keycloak.testsuite.forms.BrowserFlowTest#testAlternativeNonInteractiveExecutorInSubflow core
fix#23701 Attribute search does not work with federated users with ldap. admin/ui
fix#23980 Keycloak Operator fails to install realm authentication flow because "flow is null" import-export
fix#25490 Partial export/import is not mentioned in Keycloak's Server Administration Guide docs
fix#25687 A java.lang.NullPointerException occurs when sending a Multipart/form-data request to any file upload interface. admin/api
fix#26396 How do you update a custom user storage provider jar that includes a version number? dist/quarkus
fix#27117 user sessions not accessible in all cluster nodes infinispan
fix#27180 Grant type "urn:ietf:params:oauth:grant-type:uma-ticket" openid-connect/token service endpoint is returning refresh token with invalid Expiration authorization-services
fix#27228 Lowercased "terms_and_conditions" is not migrated in fed_user_required_action table core
fix#27245 Account console does not correctly treat link / unlink account account/ui
fix#27269 mvnw clean install -Pdistribution on Windows deletes necessary files during clean of org.keycloak:keycloak-admin-ui admin/ui
fix#27275 Invalidating offline token is not working from client sessions tab authentication
fix#27366 Social login - test failures with unexpected status code testsuite
fix#27483 Authz-client AuthorizationResource.getPermissions() ClassCastException authorization-services
fix#27504 Cpu and memory sizing typo docs
fix#27529 LegacyUserCredentialManager class not found storage
fix#27540 URL change for liquibase docs docs
fix#27548 Custom Browser Flow not working anymore admin/ui
fix#27573 Release notes from 24.0.0 miss that multi-site active-passive deployments are supported docs
fix#27597 dropping KC_PROXY=edge causes startup error core
fix#27611 Cannot modify realm email settings since keycloak 24 user-profile
fix#27653 Admin tests: Flaky realm_settings_user_profile_enabled test admin/ui
fix#27701 MTLS Cache options should be runtime options, not build time options dist/quarkus
fix#27719 Wrong Welcome page image in the documentation docs
+21 more items in the release notessecurityFixes CVE-2021-3754: Improper input validation on Keycloak allows using email as username
featureDue to an issue in the release process when deploying Keycloak using the Operator it installed the nightly container instead of 24.0.0.
featureAs a quick fix to the issue, the 24.0.0 container was tagged with nightly, and the nightly releases was temporarily disabled.
featureIf you installed or upgraded to 24.0.0 using the Operator before 5pm CET yesterday the database may have been updated with the wrong versions. To check if you are affected connect to your database and run the following SQL command:
securityFixes CVE-2024-1722: DoS via account lockout
securityFixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration
featureFine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.
featureAbility to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.
featureDynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not…
featureValidations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a particular attribute to be a URL or number.
featureAnnotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its…
featureProgressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of scope parameter. This effectively allow progressive profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user…
featureMigration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the Upgrading Guide.
featureVlastimil Eliáš
featureAlec Henninger
featureThomas Darimont
featureMarkus Till
featureSebastian Schuster
featureOliver
featurePatrick Jennings
featureAndrew
featureThe property failedLoginNotBefore has been added to the brute-force/users/{userId} endpoint
featureurn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
featureurn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName
featureurn:oasis:names:tc:SAML:2.0:nameid-format:kerberos
featureurn:oasis:names:tc:SAML:2.0:nameid-format:entity
featureurn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
featureurn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
featureurn:oasis:names:tc:SAML:2.0:nameid-format:persistent
featureurn:oasis:names:tc:SAML:2.0:nameid-format:transient
feature#15190 RestAPI endpoint "send-verify-email" sending execute actions email template. admin/api
feature#19586 @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token admin/client-js
feature#23539 User profile attributes should only accept a single value unless configured otherwise user-profile
feature#25167 Implement POST logout in Keycloak JS adapter/javascript
feature#25446 CORS SPI oidc
feature#25676 Introduce new CLI config options for Infinispan remote store dist/quarkus
feature#25702 Encrypt network communication in JGroups dist/quarkus
feature#25733 Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x
feature#25903 Create new landing page for admin console
feature#25941 Issue Verifiable Credentials in the JWT-VC format core
feature#26028 Remove conditional statements about Windows / Linux from the docs docs
feature#26250 OAuth 2.0 Grant Type SPI oidc
feature#26455 Supported option to specify maximum threads used to handle HTTP requests dist/quarkus
feature#26456 Supported option to specify resource management for pods in Keycloak CR dist/quarkus
+417 more items in the release notesfeature#26810 Shorter lifespan for offline session cache entries in memory storage
fix#22431 Localization: Admin UI doesn't pick up message bundles from realms other than master admin/ui
fix#23786 Failure: FipsDistTest ci
fix#25294 Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off ldap
fix#25731 /admin/realms/{realm}/groups Endpoint is slow admin/api
fix#25883 ldap-group-mapper fails when empty member: attribute is present ldap
fix#25912 LDAP federation reports "Creating new LDAP Store..." on every login ldap
fix#25961 Native SQL Schema names broken on MySQL storage
fix#26374 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci
fix#26529 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci
fix#26826 Freemarker erroneously escapes/sanitizes URL in template.ftl (&) login/ui
fix#27120 Microsoft social login failure testsuite
fix#26427 Operator CSV uses wrong format for `createdAt` field operator
fix#26597 Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number core
fix#26665 Unable to modify access token lifespan at realm level. Keycloak stops working. core
securityFixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration
otherBefore upgrading refer to the migration guide for a complete list of changes.
securityFixes CVE-2023-6927: keycloak-core: open redirect via "form_post.jwt" JARM response mode
otherBefore upgrading refer to the migration guide for a complete list of changes.
securityFixes CVE-2023-6291: The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
securityFixes CVE-2023-6134: Reflected XSS via wildcard in OIDC redirect_uri
otherBefore upgrading refer to the migration guide for a complete list of changes.
feature#25113 Add a test for the LoadBalancerCheck
feature#25287 Upgrade Infinispan to 14.0.21.Final
fix#24652 SAML decryption fails if keycloak.saml.deprecated.encryption flag is set saml
fix#24986 `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive core
fix#25001 Client redirect_uri check must be compared using exact string matching oidc
fix#25010 Bug: KC_DB_USERNAME environment variable is causing a crash in latest version dist/quarkus
fix#25051 Unexpected Application Error when clicking "Cancel" on user creation page admin/ui
fix#25108 Documentation Inconsistency about Open Banking(Finance) Brasil FAPI security profile docs
fix#25124 If a client does not have a URL the applications page in the account console links to about:blank account/ui
fix#25173 Make sure username is lowercase when normalizing attributes user-profile
fix#25183 NullPointerException thrown for UPConfig.getGroups() user-profile
fix#25307 Keycloak instance `HasErrors` true after update: `More than 1 secondary resource related to primary` operator
securityFixes CVE-2022-2232: LDAP Injection on UsernameForm Login
fix#23841 Users page with LDAP User Storage Provider Cannot read properties of undefined admin/ui
fix#23872 Attempt to request storage access in Firefox oidc
fix#24261 „Unlink users“-Option greyed out in ldap federation admin/ui
fix#24958 Error handling in admin console when update of user fails due the 400 HTTP error code admin/ui
fix#24961 Keycloak not able to handle multiple validating X509 certificates when public key are the same saml
fix#24984 Operator is missing CRDs metadata in CSV operator
fix#25008 Group search when creating user admin/ui
fix#25022 NPE in checkAndBindMtlsHoKToken on Token Refresh when using SuppressRefreshTokenRotationExecutor and Certificate Bound Token oidc
securityFixes CVE-2023-6484: Log Injection during WebAuthn authentication or registration
feature#23155 [WebAuthn] origin validation not support for non-Web platforms core
feature#431 Remove Wildfly/EAP OIDC and SAML adapter downloads web
feature#505 Quickstarts - Wildfly upgrade and README cleanup quickstarts
feature#510 SAML quickstart - provisioning of SAML adapter via Galleon quickstarts
feature#9318 User profile configuration API is incorrectly typed docs
feature#10128 Improve failed test behaviour operator
feature#10620 Internationalized Domain Names in email address user-profile
feature#10713 Update the server to use RESTEasy Reactive
feature#10803 Persist session in JDBC store without using external infinispan cluster storage
feature#11668 Declarative User Profile: weird behaviour in Account Management Console user-profile
feature#12406 Remove "You are already logged-in" during authentication authentication
feature#14009 CreatedTimestamp on REST import not used
feature#14165 Cannot refresh RPT tokens authorization-services
feature#14400 Add proxy options to Keycloak CR operator
feature#15018 Enhancements around proxy and hostname configuration
feature#15072 Allow setting a help text to an attribute user-profile
feature#15109 Refactor patch-sources.sh used by the Operator operator
feature#17258 Data too long for column 'DETAILS_JSON' storage
feature#20343 message bundles are not included in the realm export import-export
feature#20584 FAPI 2.0 security profile - supporting RFC 9207 OAuth 2.0 Authorization Server Issuer Identification
feature#20695 Add support for single-tenant in Microsoft Identity Provider
feature#20794 Can we simplify TokenManager.getRefreshExpiration() and TokenManager.getOfflineExpiration()? oidc
feature#20884 [Admin Console v2] Policy creation at Permissions screen missing admin/ui
feature#21073 Identity providers: pagination in admin REST API
feature#21154 Allow existing mappers for Custom Identity Providers identity-brokering
feature#21181 Add FAPI 2.0 security profile as default profile of client policies
feature#21182 Enhancing Pluggable Features of Token Manager
feature#21183 More flexibility for Introspection endpoint oidc
feature#21200 DPoP support 1st phase
feature#21444 Set `client_id` when using `private_key_jwt` with OIDC IdP identity-brokering
feature#21945 Release notes for FAPI 2
feature#22034 Keycloak, javascript lib to not use the escape() function adapter/javascript
feature#22215 DPoP verification in UserInfo endpoint oidc
feature#22318 Allow overriding Account Console resources for full control and backwards compatibility
feature#22372 Expand Group providers to allow for paginated lookup of subgroups storage
feature#22725 Do not initialize barrier build items for deployment dist/quarkus
feature#22868 Clarification on the tooltip of option "Validate Password Policy" of LDAP provider admin/ui
feature#23194 Add regex support in 'Condition - User attribute' execution authentication
feature#23340 Implement load shedding for RESTEasy reactive
+100 more items in the release notessecurityFixes CVE-2023-0105: Impersonation and lockout possible through incorrect handling of email trust
securityFixes CVE-2023-2422: Improper Client Certificate Validation for OAuth/OpenID clients
securityFixes CVE-2023-2585: Client Spoofing within the Keycloak Device Authorisation Grant
securityFixes CVE-2023-1664: Untrusted Certificate Validation
securityFixes CVE-2022-4361: Cross-site scripting when validating URI-schemes on SAML and OIDC