Keycloak 26.5.2 → 26.5.6

4 releases · 0 breaking changes · 21 security fixes · 1 advisory fixed

21security0breaking0deprecated2feature32fix

Is 26.5.2 affected? · What changed up to 26.8.1

Vulnerabilities fixed by this upgrade

7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Breaking changes

None in the release notes.

Security changes

security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3

Every release in between

26.5.6 Mar 19, 2026 Release notes ↗

security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc

security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc

security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting

security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure

security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission

security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core

security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile

security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations

fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage

fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication

fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api

fix#46379 Unexpected error when logging out with offline session and external IDP oidc

fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator

fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap

fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core

fix#46656 Em-Hyphens in SPI options on cache configuration page docs

fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan

fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange

fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations

26.5.5 Mar 5, 2026 Release notes ↗

security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService

security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login

security#46912 CVE-2026-2092 saml broker encrypted assertion injection

26.5.4 Feb 20, 2026 Release notes ↗

security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml

security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass

security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information

security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml

security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol

feature#46090 New key affinity for session ids

fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc

fix#45065 Client deletion timeout due to large number of client roles storage

fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml

fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc

fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations

fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator

fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan

fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan

fix#46150 Move upgrading note for SAML to 26.5.4 docs

fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript

fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan

fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc

fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci

26.5.3 Feb 10, 2026 Release notes ↗

security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant

security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration

security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers

security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/

feature#45892 Upgrade minikube for CI tests operator

fix#44379 Node.js admin client does not refresh tokens admin/client-js

fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus

fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus

fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus

fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite

fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci

fix#45755 Broken YAML indentation in operator rolling updates doc docs

fix#45780 Remove fatal log messages from `ConsistentHash`