Keycloak 26.5.0 → 26.5.6

6 releases · 0 breaking changes · 24 security fixes · 1 advisory fixed

24security0breaking0deprecated7feature59fix

Is 26.5.0 affected? · What changed up to 26.8.1

Vulnerabilities fixed by this upgrade

7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Breaking changes

None in the release notes.

Security changes

security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3
security #44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies in 26.5.2
security #45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability in 26.5.2
security #45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users in 26.5.2

Every release in between

26.5.6 Mar 19, 2026 Release notes ↗

security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc

security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc

security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting

security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure

security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission

security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core

security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile

security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations

fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage

fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication

fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api

fix#46379 Unexpected error when logging out with offline session and external IDP oidc

fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator

fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap

fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core

fix#46656 Em-Hyphens in SPI options on cache configuration page docs

fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan

fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange

fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations

26.5.5 Mar 5, 2026 Release notes ↗

security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService

security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login

security#46912 CVE-2026-2092 saml broker encrypted assertion injection

26.5.4 Feb 20, 2026 Release notes ↗

security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml

security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass

security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information

security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml

security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol

feature#46090 New key affinity for session ids

fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc

fix#45065 Client deletion timeout due to large number of client roles storage

fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml

fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc

fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations

fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator

fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan

fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan

fix#46150 Move upgrading note for SAML to 26.5.4 docs

fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript

fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan

fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc

fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci

26.5.3 Feb 10, 2026 Release notes ↗

security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant

security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration

security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers

security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/

feature#45892 Upgrade minikube for CI tests operator

fix#44379 Node.js admin client does not refresh tokens admin/client-js

fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus

fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus

fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus

fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite

fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci

fix#45755 Broken YAML indentation in operator rolling updates doc docs

fix#45780 Remove fatal log messages from `ConsistentHash`

26.5.2 Jan 23, 2026 Release notes ↗

security#44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies

feature#43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging

feature#45498 Ignore OpenAPI artifacts when disabled dist/quarkus

fix#44785 Can not get through SSO login if using a custom attribute with default value user-profile

fix#45015 Deadlock in Infinispan virtual threads infinispan

fix#45250 IDToken contains duplicate address claims oidc

fix#45333 User admin events don't show role, group mapping, reset password like events admin/ui

fix#45396 Database Migration fails when updating to 26.5.0 on MS SQL core

fix#45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan

fix#45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile

fix#45474 Admin REST API document is not up to date docs

fix#45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations

fix#45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus

security#45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability

fix#45584 Keycloak supported specs should list DPoP as supported oidc

fix#45590 OIDCIdentityProviderConfig issuer configuration token-exchange

fix#45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations

security#45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users

26.5.1 Jan 14, 2026 Release notes ↗

feature#44863 x-robots HTTP header missing for static Keycloak resources, and REST endpoint responses

feature#45009 Performance improvement: Missing indexes on BROKER_LINK table columns

feature#45182 Allow full managing of realms from master realm without global admin role

fix#43975 Test Framework -> Embedded server -> Maven execution failure: Failed to read script file from: scripts/default-policy.js test-framework

fix#44371 403 Forbidden when assigning realm-management client roles despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions

fix#44417 Security issue with Organization feature exposes and fills the account name automatically in user/password form organizations

fix#44783 Create Realm button is missing when user has create-realm role admin/ui

fix#44860 Admin UI: slow response time listing second user page admin/ui

fix#45003 Bug in JWTClientAuthenticator and JWTClientSecretAuthenticator causes NPE authentication

fix#45093 Enable visibility of Role Mapping tab for users with view-users role admin/ui

fix#45107 Failed upgrade to 26.4.7 - sql generated for manual database upgrade contains invalid statements storage

fix#45116 Realm-level admininistrators can no longer use Admin Console since 26.3.0 (UI fails to render) admin/ui

fix#45185 ExternalLinkTest fails due to missing _adding_context_for_log_messages anchor docs

fix#45226 Failure when decrypting SAML Response since 26.5.0 saml

fix#45239 Upgrade to 26.5.0 failing due to FK_ORG_INVITATION_ORG constraint organizations

fix#45257 Creating IdentityProvider with latest java admin-client may fail against Keycloak server 26.4 or older admin/client-java

fix#45307 UI Bug: WebAuthn passkey list is broken in keycloak v2 theme login/ui