Keycloak 26.5.2 → 26.6.2

8 releases · 0 breaking changes · 46 security fixes · 1 advisory fixed

46security0breaking1deprecated49feature63fix

Is 26.5.2 affected? · What changed up to 26.8.1

Vulnerabilities fixed by this upgrade

7.7 CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Breaking changes

None in the release notes.

Security changes

security #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service in 26.6.2
security #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing in 26.6.2
security #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services in 26.6.2
security #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations in 26.6.2
security #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core in 26.6.2
security #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn in 26.6.2
security #48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core in 26.6.2
security #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint in 26.6.2
security #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak in 26.6.2
security #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data in 26.6.2
security #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover in 26.6.2
security #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account in 26.6.2
security #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens in 26.6.2
security #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission in 26.6.2
security #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) in 26.6.2
security #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration in 26.6.2
security #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core in 26.6.1
security #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core in 26.6.1
security #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api in 26.5.7
security #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files in 26.5.7
security #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api in 26.5.7
security #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing in 26.5.7
security #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants in 26.5.7
security #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint in 26.5.7
security #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw in 26.5.7
security #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc in 26.5.6
security #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc in 26.5.6
security #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting in 26.5.6
security #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure in 26.5.6
security #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission in 26.5.6
security #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core in 26.5.6
security #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile in 26.5.6
security #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations in 26.5.6
security #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login in 26.5.5
security #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService in 26.5.5
security #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login in 26.5.5
security #46912 CVE-2026-2092 saml broker encrypted assertion injection in 26.5.5
security #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml in 26.5.4
security #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass in 26.5.4
security #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information in 26.5.4
security #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml in 26.5.4
security #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol in 26.5.4
security #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant in 26.5.3
security #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration in 26.5.3
security #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers in 26.5.3
security #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ in 26.5.3

Deprecations

deprecated #45156 Deprecate Token Exchange v1 in 26.6.0

Every release in between

26.6.2 May 19, 2026 Release notes ↗

security#47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service

security#47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing

security#47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services

security#48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations

security#48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core

security#48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn

security#48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core

security#49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint

security#49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak

security#49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data

security#49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover

security#49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account

security#49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens

security#49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission

security#49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)

security#49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration

feature#47728 Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide

feature#47734 Add dedicated "Monitoring Standbys" section to the general installation documentation

feature#48329 JDBC_PING in 26.6 should not fail with 26.7 schema changes

feature#48348 Escape expressions in JS blocks in FTL pages

feature#48687 Upgrade to Quarkus 3.33.1.1

fix#38526 Duplicate user attribute values cannot be removed core

fix#40602 Account UI reports "Something went wrong" when opening an unknown path account/ui

fix#47882 Broken link in deploy-cnpg docs

fix#47901 Realm import with --import-realm fails with ModelValidationException when Admin Permissions is enabled admin/fine-grained-permissions

fix#47915 FreeMarker templates allow instantiation of new objects and even running OS commands login/ui

fix#47987 FGAP v2 Specific Group permission has no scopes found in resource admin/fine-grained-permissions

fix#48030 Update to operator version 26.6.0 needs deletion of all objects operator

fix#48040 User session limit generates fatal error authentication

fix#48094 Wrong referenced resource type in Workflow handling for clients core

fix#48123 Clarify canonicalization in X.509 authentication authentication

fix#48143 Ordering of permission and policy calls leads to exposure of a client ID admin/api

fix#48185 Deleted workflow still attempting to run workflows

fix#48241 JavaScript Injection in frontchannel-logout.ftl via frontchannel-logout.title authentication

fix#48259 Kubernetes identity providers docs still mention it to be a preview feature docs

fix#48313 No escape approach for JS code inside the front channel logout FTL login/ui

fix#48536 Review migration guide for rolling updates changes workflows

fix#48629 WindowsServiceDistTest.testServiceLifecycle fails on slower runners due to insufficient startup timeout ci

26.6.1 Apr 15, 2026 Release notes ↗

security#47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core

security#47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core

feature#47839 Update CloudNativePG to 1.29

feature#47909 Database data at rest encryption

fix#47435 AuroraDB IT CI workflow not cleaning up databases testsuite

fix#47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail testsuite

fix#47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope oidc

fix#47827 az vm create fails with JSON parsing error ci

fix#47872 v26.6.0 Operator flood logs with warnings operator

fix#47889 Not possible to sync latest keycloak-admin-client to keycloak-client admin/client-java

fix#47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0 admin/client-js

fix#47905 invalid package reference in keycloak-admin-ui admin/ui

fix#47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication organizations

fix#47929 User profile multiselect options not highlighted as selected in dropdown admin/ui

fix#47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint identity-brokering

fix#48015 Missing explicit docs anchor for organizations docs

fix#48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap dist/quarkus

26.6.0 Apr 8, 2026 Release notes ↗

featureJWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions.

featureFederated client authentication, eliminating the need to manage individual client secrets in Keycloak.

featureWorkflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management.

featureZero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime.

featureThe Keycloak Test Framework, replacing the previous Arquillian-based solution.

featureConfigure TLS for the database connection.

featureDatabase connection timeouts.

featureTransaction timeouts with production-ready defaults.

feature/var/run/secrets/kubernetes.io/serviceaccount/ca.crt (Kubernetes service account CA)

feature/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt (OpenShift service CA)

deprecated#45156 Deprecate Token Exchange v1

feature#10155 Step-up authentication for SAML clients authentication

feature#13102 Add support for specifying `client.secret` using vault core

feature#39888 Workflows

feature#42634 Federated client authentication

feature#43144 OAuth Identity and Authorization Chaining Across Domains

feature#43146 New test framework

feature#43152 Authorization Grants

feature#43252 Zero-downtime upgrades between patch releases of Keycloak

feature#43257 Support a Kubernetes Native Database

feature#43507 Add support for Organization-specific Groups

feature#43576 Authorization grant for social providers token-exchange/federated

feature#44833 [OID4VCI] Make natural_person configuration available in all formats oid4vc

feature#45106 OAuth Client ID Metadata Document

feature#45284 CIMD - Persistent CIMD oidc

feature#46633 keycloak operator: add support for different port and name for the kubernetes service definition in the keycloak CRD

feature#47011 Add debug helper utility to the test framework test-framework

feature#10618 Enhancements to logging config dist/quarkus

feature#14523 Add support for enforced password change with LDAP federation ldap

feature#17904 Support RTL UI account/ui

feature#19374 Allow absolute path for cache-config-file? dist/quarkus

feature#19453 The default database transaction timeout should not be applied to Liquibase or data migrations dist/quarkus

feature#20618 Support enabling access logs dist/quarkus

feature#27986 Remove Liquibase dependency version from Keycloak root pom

feature#33160 Add support for X509 client certificate lookup for Envoy

feature#33198 Introduce `resourcesCommonUrl` for E-Mail templates core

feature#33818 Request for Enhancement: Make x509cert-lookup SPI public

feature#34435 OTEL: Add tracing ID to user facing error message observability

feature#35298 Reverse proxy provided context path not working despite setting X-Forwarded-Prefix header dist/quarkus

feature#36226 Provide a read only view of Identity Provider Mappers configuration screen to the Keycloak Admin UI

+333 more items in the release notes

26.5.7 Apr 2, 2026 Release notes ↗

security#45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api

security#45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files

security#47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api

security#47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing

security#47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

security#47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

security#47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

feature#46631 Upgrade to Quarkus 3.27.3 dist/quarkus

fix#45204 Call without Host header throws uncaught error core

26.5.6 Mar 19, 2026 Release notes ↗

security#45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc

security#45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc

security#45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting

security#45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure

security#46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission

security#46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core

security#46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile

security#47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations

fix#45889 Federated user disabled when external DB unavailable, never re-enabled storage

fix#46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication

fix#46296 UsersResource.search briefRepresentation started to return user attributes admin/api

fix#46379 Unexpected error when logging out with offline session and external IDP oidc

fix#46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator

fix#46588 Partial LDAP sync duration does not follow the defined value in user federation ldap

fix#46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core

fix#46656 Em-Hyphens in SPI options on cache configuration page docs

fix#46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan

fix#46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange

fix#47079 Do not allow fetching organizations of a member if not a member of the current organization organizations

26.5.5 Mar 5, 2026 Release notes ↗

security#46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login

security#46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService

security#46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login

security#46912 CVE-2026-2092 saml broker encrypted assertion injection

26.5.4 Feb 20, 2026 Release notes ↗

security#45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml

security#45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass

security#45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information

security#46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml

security#46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol

feature#46090 New key affinity for session ids

fix#44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc

fix#45065 Client deletion timeout due to large number of client roles storage

fix#45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml

fix#45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc

fix#45874 Disabled organizations still resolve in organization‑aware login flows organizations

fix#45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator

fix#45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan

fix#46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan

fix#46150 Move upgrading note for SAML to 26.5.4 docs

fix#46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript

fix#46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan

fix#46303 JWT Authorization Grant: Always getting “Token was issued too far in the past to be used now” for EntraID issued tokens oidc

fix#46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gson.JsonObject.get(String)" is null ci

26.5.3 Feb 10, 2026 Release notes ↗

security#46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant

security#46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration

security#46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers

security#46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/

feature#45892 Upgrade minikube for CI tests operator

fix#44379 Node.js admin client does not refresh tokens admin/client-js

fix#45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus

fix#45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus

fix#45677 Hibernate Validator is enabled by default when not used dist/quarkus

fix#45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite

fix#45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci

fix#45755 Broken YAML indentation in operator rolling updates doc docs

fix#45780 Remove fatal log messages from `ConsistentHash`