Keycloak 26.4.5 → 26.6.0

11 releases · 1 breaking change · 32 security fixes · 2 advisories fixed

32security1breaking2deprecated87feature72fix

Is 26.4.5 affected? · What changed up to 26.8.1

Vulnerabilities fixed by this upgrade

7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
5.5 CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation

Breaking changes

breaking #42905 Remove PostgreSQL 13.x support in 26.5.0

Security changes

security #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api in 26.5.7
security #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files in 26.5.7
security #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api in 26.5.7
security #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing in 26.5.7
security #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants in 26.5.7
security #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint in 26.5.7
security #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw in 26.5.7
security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3
security #44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies in 26.5.2
security #45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability in 26.5.2
security #45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users in 26.5.2
security #44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation in 26.4.6

Deprecations

deprecated #45156 Deprecate Token Exchange v1 in 26.6.0
deprecated #44121 Deprecate Fine-Grained Admin Permissions v1 admin/fine-grained-permissions in 26.5.0

Every release in between

26.6.0 Apr 8, 2026 Release notes ↗

featureJWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions.

featureFederated client authentication, eliminating the need to manage individual client secrets in Keycloak.

featureWorkflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management.

featureZero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime.

featureThe Keycloak Test Framework, replacing the previous Arquillian-based solution.

featureConfigure TLS for the database connection.

featureDatabase connection timeouts.

featureTransaction timeouts with production-ready defaults.

feature/var/run/secrets/kubernetes.io/serviceaccount/ca.crt (Kubernetes service account CA)

feature/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt (OpenShift service CA)

deprecated#45156 Deprecate Token Exchange v1

feature#10155 Step-up authentication for SAML clients authentication

feature#13102 Add support for specifying `client.secret` using vault core

feature#39888 Workflows

feature#42634 Federated client authentication

feature#43144 OAuth Identity and Authorization Chaining Across Domains

feature#43146 New test framework

feature#43152 Authorization Grants

feature#43252 Zero-downtime upgrades between patch releases of Keycloak

feature#43257 Support a Kubernetes Native Database

feature#43507 Add support for Organization-specific Groups

feature#43576 Authorization grant for social providers token-exchange/federated

feature#44833 [OID4VCI] Make natural_person configuration available in all formats oid4vc

feature#45106 OAuth Client ID Metadata Document

feature#45284 CIMD - Persistent CIMD oidc

feature#46633 keycloak operator: add support for different port and name for the kubernetes service definition in the keycloak CRD

feature#47011 Add debug helper utility to the test framework test-framework

feature#10618 Enhancements to logging config dist/quarkus

feature#14523 Add support for enforced password change with LDAP federation ldap

feature#17904 Support RTL UI account/ui

feature#19374 Allow absolute path for cache-config-file? dist/quarkus

feature#19453 The default database transaction timeout should not be applied to Liquibase or data migrations dist/quarkus

feature#20618 Support enabling access logs dist/quarkus

feature#27986 Remove Liquibase dependency version from Keycloak root pom

feature#33160 Add support for X509 client certificate lookup for Envoy

feature#33198 Introduce `resourcesCommonUrl` for E-Mail templates core

feature#33818 Request for Enhancement: Make x509cert-lookup SPI public

feature#34435 OTEL: Add tracing ID to user facing error message observability

feature#35298 Reverse proxy provided context path not working despite setting X-Forwarded-Prefix header dist/quarkus

feature#36226 Provide a read only view of Identity Provider Mappers configuration screen to the Keycloak Admin UI

+333 more items in the release notes

26.5.7 Apr 2, 2026 Release notes ↗

security#45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api

security#45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files

security#47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api

security#47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing

security#47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

security#47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

security#47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

feature#46631 Upgrade to Quarkus 3.27.3 dist/quarkus

fix#45204 Call without Host header throws uncaught error core

26.5.6 Mar 19, 2026 Release notes ↗

security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc

security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc

security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting

security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure

security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission

security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core

security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile

security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations

fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage

fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication

fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api

fix#46379 Unexpected error when logging out with offline session and external IDP oidc

fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator

fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap

fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core

fix#46656 Em-Hyphens in SPI options on cache configuration page docs

fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan

fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange

fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations

26.5.5 Mar 5, 2026 Release notes ↗

security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService

security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login

security#46912 CVE-2026-2092 saml broker encrypted assertion injection

26.5.4 Feb 20, 2026 Release notes ↗

security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml

security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass

security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information

security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml

security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol

feature#46090 New key affinity for session ids

fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc

fix#45065 Client deletion timeout due to large number of client roles storage

fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml

fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc

fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations

fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator

fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan

fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan

fix#46150 Move upgrading note for SAML to 26.5.4 docs

fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript

fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan

fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc

fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci

26.5.3 Feb 10, 2026 Release notes ↗

security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant

security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration

security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers

security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/

feature#45892 Upgrade minikube for CI tests operator

fix#44379 Node.js admin client does not refresh tokens admin/client-js

fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus

fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus

fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus

fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite

fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci

fix#45755 Broken YAML indentation in operator rolling updates doc docs

fix#45780 Remove fatal log messages from `ConsistentHash`

26.5.2 Jan 23, 2026 Release notes ↗

security#44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies

feature#43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging

feature#45498 Ignore OpenAPI artifacts when disabled dist/quarkus

fix#44785 Can not get through SSO login if using a custom attribute with default value user-profile

fix#45015 Deadlock in Infinispan virtual threads infinispan

fix#45250 IDToken contains duplicate address claims oidc

fix#45333 User admin events don't show role, group mapping, reset password like events admin/ui

fix#45396 Database Migration fails when updating to 26.5.0 on MS SQL core

fix#45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan

fix#45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile

fix#45474 Admin REST API document is not up to date docs

fix#45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations

fix#45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus

security#45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability

fix#45584 Keycloak supported specs should list DPoP as supported oidc

fix#45590 OIDCIdentityProviderConfig issuer configuration token-exchange

fix#45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations

security#45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users

26.5.1 Jan 14, 2026 Release notes ↗

feature#44863 x-robots HTTP header missing for static Keycloak resources, and REST endpoint responses

feature#45009 Performance improvement: Missing indexes on BROKER_LINK table columns

feature#45182 Allow full managing of realms from master realm without global admin role

fix#43975 Test Framework -> Embedded server -> Maven execution failure: Failed to read script file from: scripts/default-policy.js test-framework

fix#44371 403 Forbidden when assigning realm-management client roles despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions

fix#44417 Security issue with Organization feature exposes and fills the account name automatically in user/password form organizations

fix#44783 Create Realm button is missing when user has create-realm role admin/ui

fix#44860 Admin UI: slow response time listing second user page admin/ui

fix#45003 Bug in JWTClientAuthenticator and JWTClientSecretAuthenticator causes NPE authentication

fix#45093 Enable visibility of Role Mapping tab for users with view-users role admin/ui

fix#45107 Failed upgrade to 26.4.7 - sql generated for manual database upgrade contains invalid statements storage

fix#45116 Realm-level admininistrators can no longer use Admin Console since 26.3.0 (UI fails to render) admin/ui

fix#45185 ExternalLinkTest fails due to missing _adding_context_for_log_messages anchor docs

fix#45226 Failure when decrypting SAML Response since 26.5.0 saml

fix#45239 Upgrade to 26.5.0 failing due to FK_ORG_INVITATION_ORG constraint organizations

fix#45257 Creating IdentityProvider with latest java admin-client may fail against Keycloak server 26.4 or older admin/client-java

fix#45307 UI Bug: WebAuthn passkey list is broken in keycloak v2 theme login/ui

26.5.0 Jan 6, 2026 Release notes ↗

featureWorkflows to automate administrative tasks and process within a realm.

featureJWT Authorization Grants, our recommended alternative to external to internal token exchange.

featureGuide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers.

featureAuthenticating clients with Kubernetes service account tokens to avoid static client secrets.

featureOpenTelemetry support for metrics and logging, combining all observability information in this popular standard.

featureView all sent invitations with their current status (Pending, Expired)

featureResend pending invitations to recipients

featureDelete invitation records from the system

featureFilter invitations by status for easier management

deprecated#44121 Deprecate Fine-Grained Admin Permissions v1 admin/fine-grained-permissions

breaking#42905 Remove PostgreSQL 13.x support

feature#20761 Support Caddy as a Reverse Proxy Provider for Client Certificate Authentication core

feature#37704 Support for running Keycloak as a Windows Service

feature#38809 Feature Request: Track Pending Organization Invitations in Keycloak Admin Console

feature#39221 Admin API v2: Blueprint

feature#41261 OpenTelemetry Support observability

feature#42482 Possibility to backchannel logout the clients belonging to a specific user session

feature#42912 Containers for ppc64le

feature#43020 Secure Client-Initiated Renegotiation - disable by default dist/quarkus

feature#43106 Expose scheduled tasks and start time

feature#44312 Add support to use `kcw` with remote test server test-framework

feature#44458 Expose a configuration option to always display a logout confirmation screen

feature#8863 Add CORS support to OIDC dynamic client registration endpoints

feature#10388 Allow to hide client scopes from scopes_supported in discovery endpoint

feature#12682 Allow CORS Access-Control-Allow-Headers customization core

feature#14509 Allow configuration for SMTP timeouts via configuration

feature#15502 Ability to remove offline_access tokens from the Account Management client and/or Admin interface core

feature#17268 [KC 20+] Obsolete/wrong documentation about service accounts?

feature#22938 Fine-grained admin permission client manage does not work for an Authorization enabled client admin/fine-grained-permissions

feature#33009 Delete Client and role's admin event doesn't have representation while other delete entities have the representation admin/ui

feature#33146 Prevent users configuring max-count=-1 for caches with a default upper-bound infinispan

feature#35836 SMTP Timeout Override

feature#38843 Set `automountServiceAccountToken: false` on Keycloak pods operator

feature#39881 Picture of the token-exchange flow in the documentation docs

feature#40799 Provide a way to add custom labels to Realm Import job of Keycloak operator

feature#41006 [OTel] Micrometer to OpenTelemetry bridge support for metrics observability

feature#41007 Including OTLP headers for authorization

feature#41019 Validate client session session timeout and lifetime settings on edit authentication

feature#41205 Make MDC logging supported

feature#41263 [OTel] Provide general options for telemetry settings observability

+302 more items in the release notes

26.4.7 Dec 1, 2025 Release notes ↗

feature#43156 [Docs] Warn users about printing headers in HTTP access logs docs

feature#43643 Upgrade to Quarkus 3.27.1 dist/quarkus

fix#44438 Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients saml

fix#44480 Wrong persistent group permissions when multiple group membership changes happen in the same request core

26.4.6 Nov 25, 2025 Release notes ↗

security#44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation

fix#43323 Sessions not removed when user is deleted infinispan

fix#43738 UPDATE_EMAIL action invalidates old email login/ui

fix#43754 Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest ci

fix#43812 Admin console sends non-JSON payload with content-type: application/json admin/ui

fix#44125 Double-encoding of query parameter values (e.g. acr_values) for version 26.4 identity-brokering

fix#44187 [Keycloak Docs CI] Broken links docs

fix#44189 [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry infinispan

fix#44229 Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions infinispan

fix#44269 Admin Client creates malformed paths for requests admin/client-js

fix#44287 Caching of static theme resources in dev mode is disabled core