Keycloak 26.5.0 → 26.7.2
15 releases · 3 breaking changes · 108 security fixes · 15 advisories fixed
108security3breaking2deprecated82feature136fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- 8.8 CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- 6.5 CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
- 7.4 CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
- 5.4 CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
- 8.1 CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- 7.7 CVE-2026-9099 group-admin escalation to realm-admin
- 4.9 CVE-2026-9083 Information disclosure through arbitrary filesystem path probing
- 7.3 CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass
- 6.5 CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token
- 7.3 CVE-2026-9795 Privilege escalation via improper scope mapping enforcement
- 4.6 CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass
- 8.1 CVE-2026-9800 Authorization bypass via incorrect uri comparison
- 8.1 CVE-2026-11800 Authentication bypass via jwt algorithm confusion
- 7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Breaking changes
- breaking #44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering in 26.7.0
- breaking #48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated in 26.7.0
- breaking #49270 Remove the batching option for the persistent sessions in 26.7.0
Security changes
- security #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies in 26.7.2
- security #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions in 26.7.2
- security #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix in 26.7.2
- security #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions in 26.7.2
- security #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc in 26.7.2
- security #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client in 26.7.2
- security #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass in 26.7.2
- security #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc in 26.7.1
- security #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api in 26.7.1
- security #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions in 26.7.1
- security #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions in 26.7.1
- security #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions in 26.7.1
- security #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher in 26.7.1
- security #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation in 26.7.1
- security #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text in 26.7.1
- security #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction in 26.7.1
- security #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation in 26.7.1
- security #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary in 26.7.1
- security #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers in 26.7.1
- security Fixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher in 26.7.0
- security Client-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. in 26.7.0
- security Confidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. in 26.7.0
- security OAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. in 26.7.0
- security Session-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. in 26.7.0
- security Polishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API. in 26.7.0
- security Lots of bugs fixed. Improved specification compliance. in 26.7.0
- security Conformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA). in 26.7.0
- security Management of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from… in 26.7.0
- security Pre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code in 26.7.0
- security Support for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults… in 26.7.0
- security Documentation updated and improved in 26.7.0
- security #49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac in 26.7.0
- security #49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc in 26.7.0
- security #49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc in 26.7.0
- security #49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions in 26.7.0
- security #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin in 26.6.4
- security #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing in 26.6.4
- security #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass in 26.6.4
- security #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token in 26.6.4
- security #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement in 26.6.4
- security #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass in 26.6.4
- security #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison in 26.6.4
- security #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion in 26.6.4
- security #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui in 26.6.3
- security #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc in 26.6.3
- security #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services in 26.6.3
- security #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api in 26.6.3
- security #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization in 26.6.3
- security #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc in 26.6.3
- security #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn in 26.6.3
- security #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions in 26.6.3
- security #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering in 26.6.3
- security #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc in 26.6.3
- security #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml in 26.6.3
- security #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations in 26.6.3
- security #49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api in 26.6.3
- security #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap in 26.6.3
- security #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc in 26.6.3
- security #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc in 26.6.3
- security #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service in 26.6.2
- security #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing in 26.6.2
- security #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services in 26.6.2
- security #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations in 26.6.2
- security #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core in 26.6.2
- security #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn in 26.6.2
- security #48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core in 26.6.2
- security #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint in 26.6.2
- security #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak in 26.6.2
- security #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data in 26.6.2
- security #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover in 26.6.2
- security #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account in 26.6.2
- security #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens in 26.6.2
- security #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission in 26.6.2
- security #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) in 26.6.2
- security #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration in 26.6.2
- security #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core in 26.6.1
- security #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core in 26.6.1
- security #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api in 26.5.7
- security #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files in 26.5.7
- security #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api in 26.5.7
- security #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing in 26.5.7
- security #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants in 26.5.7
- security #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint in 26.5.7
- security #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw in 26.5.7
- security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
- security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
- security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
- security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
- security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
- security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
- security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
- security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
- security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
- security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
- security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
- security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
- security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
- security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
- security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
- security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
- security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
- security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
- security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
- security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
- security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3
- security #44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies in 26.5.2
- security #45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability in 26.5.2
- security #45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users in 26.5.2
Deprecations
- deprecated #49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui in 26.7.0
- deprecated #45156 Deprecate Token Exchange v1 in 26.6.0
Every release in between
security#49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies
security#50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions
security#50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix
security#50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions
security#51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc
security#51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client
security#51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass
other#50844 show-config prints the vault keystore password in cleartext dist/quarkus
feature#51344 Upgrade to Quarkus 3.33.3.1
fix#50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication
fix#50849 Correct SCIM name.formated scim
fix#50855 Rotated client secret remains valid when the feature is disabled oidc
fix#51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui
fix#51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core
fix#51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn
fix#51088 Verify email not working in incognito browser tab after Keycloak restart authentication
fix#51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core
fix#51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan
fix#51164 WebAuthn tests are being skipped in Github workflows workflows
fix#51182 Large HTTP/2 request headers are rejected with a bare 500 and no log; same request works over HTTP/1.1 dist/quarkus
fix#51323 Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 admin/rbac
fix#51331 Adding org member fails with 500 with stateless:v1 feature enabled organizations
fix#51407 The dist for Java API docs is empty docs
fix#51449 Incorrect query parameter name for "max"
fix#51476 Invalid link for https://www.ietf.org/rfc/rfc4559.txt docs
security#49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc
security#50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api
security#50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions
security#50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions
security#50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions
security#51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher
security#51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation
security#51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text
security#51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction
security#51471 CVE-2026-16443 SAML broker metadata import disables response signature validation
security#51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary
security#51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers
fix#50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn
fix#50750 Clustering test broken in 26.7 release branch ci
fix#50836 Kustomize cluster-wide faulty Role&RoleBinding operator
fix#50850 New Password is commited when multiple Password Reset is detected authentication
fix#50882 500 when client requests `organization` scope with it already set to `Default` authentication
fix#50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core
securityFixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
featureAutomate user provisioning with the SCIM API (preview)
featureSimplified multi-cluster high availability without external caches (preview)
featureEnhanced reverse proxy guides with blueprints for HAProxy and Traefik
featureStep-up authentication for SAML clients
securityClient-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.
securityConfidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.
securityOAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields.
securitySession-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions.
securityPolishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API.
securityLots of bugs fixed. Improved specification compliance.
securityConformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA).
securityManagement of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from…
securityPre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code
securitySupport for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults…
securityDocumentation updated and improved
featuremanage-organizations — grants full read and write access to organizations, including creating, updating, and deleting organizations and their members.
featureview-organizations — grants read-only access to organizations and their members (also requires view-users or Fine-Grained Admin Permissions for user visibility).
featurequery-organizations — grants the ability to search and list organizations without full view access, consistent with the query-users / query-clients / query-groups pattern.
security#49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac
security#49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc
security#49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc
security#49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions
deprecated#49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui
feature#50460 SSF push URL allow-list bypass via authority-attached wildcard ssf
breaking#44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering
breaking#48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated
breaking#49270 Remove the batching option for the persistent sessions
feature#9686 Store the Dynamic Scope parameter to avoid showing the Consent Screen every time there's an authentication
feature#20128 Add support for `reencrypt` OpenShift Routes to the Operator operator
feature#22042 More flexible imports in custom theme (i.e. CSS media queries) account/ui
feature#35650 Compatibility profiles
feature#44317 [OID4VCI] Add a client policy to require a credential offer
feature#46543 Step-up authentication for SAML - supported authentication
feature#48623 Make the admin client, from the admin-ui more easy to use
feature#9915 Make the consent screen text for dynamic scopes customizable with a reference to the dynamic scope parameter
feature#10696 Improve WebAuthn tests documentation testsuite
feature#12223 Dynamic scopes: requested scopes get mixed up between token requests oidc
feature#17758 [UX Review] Optimize the number box in the Time-policy creation page of client Authorization admin/ui
feature#17762 [UX Review] Optimize the initial page of Keys in OIDC client admin/ui
+317 more items in the release notessecurity#50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
security#50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
security#50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
security#50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
security#50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
security#50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
security#50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison
security#50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion
feature#50100 Upgrade to Quarkus 3.33.2.1
fix#47999 [Keycloak JavaScript CI] - Build Keycloak ci
fix#49639 Keycloak Admin Client tests fails in CI ci
fix#49700 Incorrect migration guide reference docs
fix#49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan
fix#49733 keycloak-api-docs-dist is not deployable dist/quarkus
security#47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui
security#47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc
security#48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services
security#48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api
security#48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
security#49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc
security#49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn
security#49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions
security#49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering
security#49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc
security#49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml
security#49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations
security#49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api
security#49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap
security#49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc
security#49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc
feature#48311 Upgrade to Quarkus 3.33.2 dist/quarkus
feature#48695 Add startup check for missing database indexes
feature#49148 Add SPI option to disable FD_SOCK2 failure detection
feature#49526 Update to simple-git 3.36.0
feature#49530 Update to uuid >=13.0.1
fix#45957 Handling of CORS requests in the Admin UI ineffective / open for CSRF admin/ui
fix#47036 Account ResourceService user endpoint returns excessive user data in UMA-enabled realms core
fix#48324 UMA IS_ADMIN filter breaks ticket finding authorization-services
fix#48430 Wildcard redirect URI matching does not enforce host boundary when * is placed directly after hostname oidc
fix#48432 ClientAdapter using wrong value for isFrontChannelLogout oidc
fix#48438 Keycloak 26.6.0/26.6.1 exits (code 1) ~100ms after async realm migration completes; migrations not persisted core
fix#48455 ContextNotActiveException during error handling core
fix#48464 Incomplete SCIM schema definition for objects scim
fix#48529 Broken downstream docs formatting on Kubernetes topic docs
fix#48584 Updating Keycloak to 26.6.x fails on SQL Server with case sensitive collation core
fix#48628 Client registerNode and unregisterNode endpoints fail authenticating the client core
fix#48681 ExternalLinksTest: oasis-open.org/standard/saml/ returns 403 in CI causing flaky documentation check ci
fix#48716 Missing index IDX_IDP_FOR_LOGIN and IDX_CLIENT_ATT_BY_NAME_VALUE for Microsoft SQL Server core
fix#48744 Input validation/ Unhandled NullPointerException on alg:none JWT in Bearer Authentication authentication
fix#48792 Virtual Thread checking is not working infinispan
fix#48806 NPE when accessing Account UI and the ACCOUNT feature is disabled account/api
fix#48877 Keycloak 26.6.1 does not persist UPDATE_PASSWORD for LDAP/AD federated users after temporary password reset ldap
fix#48904 Consistent 500 on DELETE of realms via non-browser clients calling REST API admin/api
fix#49058 Keycloak fails to run tests with embedded undertow dist/quarkus
+17 more items in the release notessecurity#47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
security#47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
security#47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services
security#48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations
security#48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core
security#48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn
security#48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core
security#49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint
security#49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak
security#49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data
security#49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover
security#49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account
security#49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens
security#49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission
security#49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)
security#49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration
feature#47728 Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide
feature#47734 Add dedicated "Monitoring Standbys" section to the general installation documentation
feature#48329 JDBC_PING in 26.6 should not fail with 26.7 schema changes
feature#48348 Escape expressions in JS blocks in FTL pages
feature#48687 Upgrade to Quarkus 3.33.1.1
fix#38526 Duplicate user attribute values cannot be removed core
fix#40602 Account UI reports "Something went wrong" when opening an unknown path account/ui
fix#47882 Broken link in deploy-cnpg docs
fix#47901 Realm import with --import-realm fails with ModelValidationException when Admin Permissions is enabled admin/fine-grained-permissions
fix#47915 FreeMarker templates allow instantiation of new objects and even running OS commands login/ui
fix#47987 FGAP v2 Specific Group permission has no scopes found in resource admin/fine-grained-permissions
fix#48030 Update to operator version 26.6.0 needs deletion of all objects operator
fix#48040 User session limit generates fatal error authentication
fix#48094 Wrong referenced resource type in Workflow handling for clients core
fix#48123 Clarify canonicalization in X.509 authentication authentication
fix#48143 Ordering of permission and policy calls leads to exposure of a client ID admin/api
fix#48185 Deleted workflow still attempting to run workflows
fix#48241 JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title authentication
fix#48259 Kubernetes identity providers docs still mention it to be a preview feature docs
fix#48313 No escape approach for JS code inside the front channel logout FTL login/ui
fix#48536 Review migration guide for rolling updates changes workflows
fix#48629 WindowsServiceDistTest.testServiceLifecycle fails on slower runners due to insufficient startup timeout ci
security#47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core
security#47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core
feature#47839 Update CloudNativePG to 1.29
feature#47909 Database data at rest encryption
fix#47435 AuroraDB IT CI workflow not cleaning up databases testsuite
fix#47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail testsuite
fix#47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope oidc
fix#47827 az vm create fails with JSON parsing error ci
fix#47872 v26.6.0 Operator flood logs with warnings operator
fix#47889 Not possible to sync latest keycloak-admin-client to keycloak-client admin/client-java
fix#47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0 admin/client-js
fix#47905 invalid package reference in keycloak-admin-ui admin/ui
fix#47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication organizations
fix#47929 User profile multiselect options not highlighted as selected in dropdown admin/ui
fix#47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint identity-brokering
fix#48015 Missing explicit docs anchor for organizations docs
fix#48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap dist/quarkus
featureJWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions.
featureFederated client authentication, eliminating the need to manage individual client secrets in Keycloak.
featureWorkflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management.
featureZero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime.
featureThe Keycloak Test Framework, replacing the previous Arquillian-based solution.
featureConfigure TLS for the database connection.
featureDatabase connection timeouts.
featureTransaction timeouts with production-ready defaults.
feature/var/run/secrets/kubernetes.io/serviceaccount/ca.crt (Kubernetes service account CA)
feature/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt (OpenShift service CA)
deprecated#45156 Deprecate Token Exchange v1
feature#10155 Step-up authentication for SAML clients authentication
feature#13102 Add support for specifying `client.secret` using vault core
feature#39888 Workflows
feature#42634 Federated client authentication
feature#43144 OAuth Identity and Authorization Chaining Across Domains
feature#43146 New test framework
feature#43152 Authorization Grants
feature#43252 Zero-downtime upgrades between patch releases of Keycloak
feature#43257 Support a Kubernetes Native Database
feature#43507 Add support for Organization-specific Groups
feature#43576 Authorization grant for social providers token-exchange/federated
feature#44833 [OID4VCI] Make natural_person configuration available in all formats oid4vc
feature#45106 OAuth Client ID Metadata Document
feature#45284 CIMD - Persistent CIMD oidc
feature#46633 keycloak operator: add support for different port and name for the kubernetes service definition in the keycloak CRD
feature#47011 Add debug helper utility to the test framework test-framework
feature#10618 Enhancements to logging config dist/quarkus
feature#14523 Add support for enforced password change with LDAP federation ldap
feature#17904 Support RTL UI account/ui
feature#19374 Allow absolute path for cache-config-file? dist/quarkus
feature#19453 The default database transaction timeout should not be applied to Liquibase or data migrations dist/quarkus
feature#20618 Support enabling access logs dist/quarkus
feature#27986 Remove Liquibase dependency version from Keycloak root pom
feature#33160 Add support for X509 client certificate lookup for Envoy
feature#33198 Introduce `resourcesCommonUrl` for E-Mail templates core
feature#33818 Request for Enhancement: Make x509cert-lookup SPI public
feature#34435 OTEL: Add tracing ID to user facing error message observability
feature#35298 Reverse proxy provided context path not working despite setting X-Forwarded-Prefix header dist/quarkus
feature#36226 Provide a read only view of Identity Provider Mappers configuration screen to the Keycloak Admin UI
+333 more items in the release notessecurity#45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api
security#45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files
security#47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api
security#47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing
security#47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
security#47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
security#47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
feature#46631 Upgrade to Quarkus 3.27.3 dist/quarkus
fix#45204 Call without Host header throws uncaught error core
security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc
security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc
security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting
security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure
security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission
security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core
security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile
security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations
fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage
fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication
fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api
fix#46379 Unexpected error when logging out with offline session and external IDP oidc
fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator
fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap
fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core
fix#46656 Em-Hyphens in SPI options on cache configuration page docs
fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan
fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange
fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations
security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login
security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService
security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login
security#46912 CVE-2026-2092 saml broker encrypted assertion injection
security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml
security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass
security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information
security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml
security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol
feature#46090 New key affinity for session ids
fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc
fix#45065 Client deletion timeout due to large number of client roles storage
fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml
fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc
fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations
fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator
fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan
fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan
fix#46150 Move upgrading note for SAML to 26.5.4 docs
fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript
fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan
fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc
fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci
security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant
security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration
security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers
security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/
feature#45892 Upgrade minikube for CI tests operator
fix#44379 Node.js admin client does not refresh tokens admin/client-js
fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus
fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus
fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus
fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite
fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci
fix#45755 Broken YAML indentation in operator rolling updates doc docs
fix#45780 Remove fatal log messages from `ConsistentHash`
security#44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies
feature#43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging
feature#45498 Ignore OpenAPI artifacts when disabled dist/quarkus
fix#44785 Can not get through SSO login if using a custom attribute with default value user-profile
fix#45015 Deadlock in Infinispan virtual threads infinispan
fix#45250 IDToken contains duplicate address claims oidc
fix#45333 User admin events don't show role, group mapping, reset password like events admin/ui
fix#45396 Database Migration fails when updating to 26.5.0 on MS SQL core
fix#45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan
fix#45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile
fix#45474 Admin REST API document is not up to date docs
fix#45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations
fix#45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus
security#45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability
fix#45584 Keycloak supported specs should list DPoP as supported oidc
fix#45590 OIDCIdentityProviderConfig issuer configuration token-exchange
fix#45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations
security#45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users
feature#44863 x-robots HTTP header missing for static Keycloak resources, and REST endpoint responses
feature#45009 Performance improvement: Missing indexes on BROKER_LINK table columns
feature#45182 Allow full managing of realms from master realm without global admin role
fix#43975 Test Framework -> Embedded server -> Maven execution failure: Failed to read script file from: scripts/default-policy.js test-framework
fix#44371 403 Forbidden when assigning realm-management client roles despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions
fix#44417 Security issue with Organization feature exposes and fills the account name automatically in user/password form organizations
fix#44783 Create Realm button is missing when user has create-realm role admin/ui
fix#44860 Admin UI: slow response time listing second user page admin/ui
fix#45003 Bug in JWTClientAuthenticator and JWTClientSecretAuthenticator causes NPE authentication
fix#45093 Enable visibility of Role Mapping tab for users with view-users role admin/ui
fix#45107 Failed upgrade to 26.4.7 - sql generated for manual database upgrade contains invalid statements storage
fix#45116 Realm-level admininistrators can no longer use Admin Console since 26.3.0 (UI fails to render) admin/ui
fix#45185 ExternalLinkTest fails due to missing _adding_context_for_log_messages anchor docs
fix#45226 Failure when decrypting SAML Response since 26.5.0 saml
fix#45239 Upgrade to 26.5.0 failing due to FK_ORG_INVITATION_ORG constraint organizations
fix#45257 Creating IdentityProvider with latest java admin-client may fail against Keycloak server 26.4 or older admin/client-java
fix#45307 UI Bug: WebAuthn passkey list is broken in keycloak v2 theme login/ui