Keycloak 26.6.4 → 26.8.2
9 releases · 6 breaking changes · 145 security fixes · 6 advisories fixed
145security6breaking7deprecated45feature95fix
Vulnerabilities fixed by this upgrade
- 8.1 CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- 8.8 CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- 6.5 CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
- 7.4 CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
- 5.4 CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
- 8.1 CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
Breaking changes
- breaking #51897 Deprecate route from AUTH_SESSION_ID cookie for sticky sessions in 26.8.0
- breaking #52130 Deprecate clusterless feature in 26.8.0
- breaking #52480 EOL Keycloak Realm Operator in 26.8.0
- breaking #44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering in 26.7.0
- breaking #48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated in 26.7.0
- breaking #49270 Remove the batching option for the persistent sessions in 26.7.0
Security changes
- security #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations in 26.8.2
- security #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication in 26.8.2
- security #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc in 26.8.2
- security #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication in 26.8.2
- security #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus in 26.8.2
- security #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count in 26.8.2
- security #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1) in 26.8.2
- security #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache) in 26.8.2
- security #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint in 26.8.2
- security #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint in 26.8.2
- security #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName in 26.8.2
- security #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307 in 26.8.2
- security #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313 in 26.8.2
- security #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289 in 26.8.2
- security #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306 in 26.8.2
- security #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292 in 26.8.2
- security #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields in 26.8.2
- security #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression) in 26.8.2
- security #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration in 26.8.2
- security #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response in 26.8.2
- security #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290 in 26.8.2
- security #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer in 26.8.2
- security #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates in 26.8.2
- security #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims in 26.8.2
- security #54706 [CVE-2026-103112] Account Takeover via Authentication Race in 26.8.2
- security #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover in 26.8.2
- security #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation in 26.8.2
- security #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve in 26.8.2
- security #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256 in 26.8.2
- security #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession in 26.8.2
- security #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance in 26.8.2
- security #54713 [CVE-2026-19688] Admin API missing audience check in 26.8.2
- security #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user in 26.8.2
- security #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering in 26.8.1
- security #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc in 26.8.1
- security #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering in 26.8.1
- security #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
- security #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions in 26.8.1
- security #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication in 26.8.1
- security #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api in 26.8.1
- security #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services in 26.8.1
- security #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services in 26.8.1
- security #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc in 26.8.1
- security #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication in 26.8.1
- security #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
- security #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication in 26.8.1
- security #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api in 26.8.1
- security #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard in 26.8.1
- security #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability in 26.8.1
- security #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies in 26.8.1
- security #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies in 26.8.1
- security #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication in 26.8.1
- security #53582 Multiple CVEs in simple-git dependencies in 26.8.1
- security #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui in 26.8.1
- security #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api in 26.8.1
- security #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions in 26.8.1
- security #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication in 26.8.1
- security Quickstart OID4VCI deployment - a playground for rapid prototyping with mdoc and SD-JWT credentials in 26.8.0
- security OID4VCI Demo in Keycloak FAPI playground - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more. in 26.8.0
- security #50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering in 26.8.0
- security #50618 [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified oidc in 26.8.0
- security #51865 [CVE-2026-19608] Name-only group claims let same-name groups satisfy path-specific group policies authorization-services in 26.8.0
- security #52168 CVE-2026-54515 CVE-2026-59889 com.fasterxml.jackson.core:jackson-databind 2.22.0 dist/quarkus in 26.8.0
- security #52169 CVE-2026-59903 io.netty:netty-codec-http:4.1.136.Final dist/quarkus in 26.8.0
- security #51699 Missing security headers on root-path redirect when http-relative-path is configured dist/quarkus in 26.8.0
- security #52642 SCIM user deletion skips security-state cleanup in 26.8.0
- security #52645 Bulk HQL executeUpdate bypasses AsyncCommitIntegrator security classification in 26.8.0
- security #52696 Recovered sites can enforce stale security configuration for up to one hour storage in 26.8.0
- security #52676 CVE-2026-4633 User enumeration via identity-first login when Organizations feature is enabled organizations in 26.8.0
- security #50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc in 26.7.5
- security #51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc in 26.7.5
- security #51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services in 26.7.5
- security #51281 [CVE-2026-18207] Source-group condition matches duplicate group names and can skip negative-logic enforcement oidc in 26.7.5
- security #51284 [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim oidc in 26.7.5
- security #51285 [CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains oidc in 26.7.5
- security #51781 [CVE-2026-18217] SAML Redirect Binding Parameter Pollution saml in 26.7.5
- security #52531 CVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependencies in 26.7.5
- security #52692 [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET oidc in 26.7.5
- security #52783 [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts (sibling of CVE-2026-9798) oidc in 26.7.5
- security #52888 CVE-2026-84939 org.freemarker:freemarker in 26.7.5
- security #52972 CVE-2026-8798 org.bouncycastle:bc-fips dependencies in 26.7.5
- security #52974 CVE-2026-13505 org.bouncycastle:bc-fips dependencies in 26.7.5
- security #53074 [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client token-exchange in 26.7.5
- security #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts in 26.7.4
- security #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching in 26.7.4
- security #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher in 26.7.4
- security #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout in 26.7.4
- security #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator in 26.7.4
- security #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state in 26.7.4
- security #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap in 26.7.3
- security #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc in 26.7.3
- security #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations in 26.7.3
- security #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions in 26.7.3
- security #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac in 26.7.3
- security #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc in 26.7.3
- security #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions in 26.7.3
- security #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions in 26.7.3
- security #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions in 26.7.3
- security #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc in 26.7.3
- security #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange in 26.7.3
- security #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations in 26.7.3
- security #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc in 26.7.3
- security #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange in 26.7.3
- security #51378 [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions in 26.7.3
- security #51379 [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services in 26.7.3
- security #51380 [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc in 26.7.3
- security #51382 [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc in 26.7.3
- security #51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core in 26.7.3
- security #52028 [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc in 26.7.3
- security #52017 SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml in 26.7.3
- security #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies in 26.7.2
- security #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions in 26.7.2
- security #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix in 26.7.2
- security #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions in 26.7.2
- security #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc in 26.7.2
- security #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client in 26.7.2
- security #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass in 26.7.2
- security #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc in 26.7.1
- security #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api in 26.7.1
- security #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions in 26.7.1
- security #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions in 26.7.1
- security #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions in 26.7.1
- security #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher in 26.7.1
- security #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation in 26.7.1
- security #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text in 26.7.1
- security #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction in 26.7.1
- security #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation in 26.7.1
- security #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary in 26.7.1
- security #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers in 26.7.1
- security Fixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher in 26.7.0
- security Client-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. in 26.7.0
- security Confidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. in 26.7.0
- security OAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. in 26.7.0
- security Session-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. in 26.7.0
- security Polishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API. in 26.7.0
- security Lots of bugs fixed. Improved specification compliance. in 26.7.0
- security Conformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA). in 26.7.0
- security Management of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from… in 26.7.0
- security Pre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code in 26.7.0
- security Support for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults… in 26.7.0
- security Documentation updated and improved in 26.7.0
- security #49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac in 26.7.0
- security #49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc in 26.7.0
- security #49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc in 26.7.0
- security #49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions in 26.7.0
Deprecations
- deprecated #49239 Stop storing client private keys in the database and deprecate generate endpoints admin/rbac in 26.8.0
- deprecated #44062 Should Kerberos Credential delegation be deprecated? in 26.8.0
- deprecated #51921 Deprecate legacy OIDC client switches from 'OpenID Connect Compatibility Modes' oidc in 26.8.0
- deprecated #52121 Deprecate volatile sessions and allow opting out of session caching in 26.8.0
- deprecated #52923 Deprecate 'Full scope allowed' client switch oidc in 26.8.0
- deprecated #53219 Deprecate other client registration providers than OIDC in 26.8.0
- deprecated #49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui in 26.7.0
Every release in between
security#53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
security#53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
security#53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
security#53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
security#54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus
security#54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count
security#54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)
security#54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)
security#54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint
security#54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint
security#54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName
security#54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307
security#54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313
security#54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289
security#54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306
security#54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292
security#54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields
security#54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)
security#54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration
security#54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response
security#54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290
security#54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer
security#54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates
security#54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims
security#54706 [CVE-2026-103112] Account Takeover via Authentication Race
security#54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover
security#54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation
security#54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve
security#54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256
security#54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession
security#54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance
security#54713 [CVE-2026-19688] Admin API missing audience check
security#54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user
feature#54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus
fix#44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
fix#51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions
fix#52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
fix#52968 Much open UDP Sockets after some Time core
fix#53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core
fix#53507 Enhancement request suggestion in downstream documentation docs
+19 more items in the release notessecurity#50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
security#51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
security#52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
security#53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
security#53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
security#53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
security#53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
security#53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
security#53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
security#53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
security#53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
security#53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
security#53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
security#53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
security#53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
security#53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
security#53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
security#53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
security#53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
security#53582 Multiple CVEs in simple-git dependencies
security#53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
security#53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api
security#53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
fix#51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
fix#52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
fix#52362 HttpServerUtil.sendResponse drops the headers it is given core
fix#52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
security#52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
fix#52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
fix#53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
fix#53142 Realm settings - security defenses admin/ui
fix#53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
fix#53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
fix#53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
fix#53505 Broken link to FIPS documentation docs
fix#53567 Broken link to vault documentation in downstream docs
fix#53569 Fix broken link to migrating the database in downstream docs
fix#53571 Broken link in Operator Guide docs
fix#53624 Multiple link issues including incorrect names and upstream only coding docs
fix#53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
+20 more items in the release notesfeatureIssue and verify digital wallet credentials with OID4VCI and OID4VP
featureAutomate user provisioning across identity systems with the SCIM API
featureRun multi-cluster deployments without an external cache using stateless mode (now supported)
featureSimpler administration with automatic index creation, reduced memory usage, and enhanced HTTP performance
featureToken exchange delegation for AI agents and automation with consent and FGAP authorization
securityQuickstart OID4VCI deployment - a playground for rapid prototyping with mdoc and SD-JWT credentials
securityOID4VCI Demo in Keycloak FAPI playground - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more.
security#50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering
security#50618 [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified oidc
security#51865 [CVE-2026-19608] Name-only group claims let same-name groups satisfy path-specific group policies authorization-services
security#52168 CVE-2026-54515 CVE-2026-59889 com.fasterxml.jackson.core:jackson-databind 2.22.0 dist/quarkus
security#52169 CVE-2026-59903 io.netty:netty-codec-http:4.1.136.Final dist/quarkus
feature#47295 LDAP bind credentials sent to new server when connection URL is changed ldap
deprecated#49239 Stop storing client private keys in the database and deprecate generate endpoints admin/rbac
feature#49784 UserInfo Endpoint: Add null-check for SignatureProvider when validating JWT bearer tokens oidc
feature#50469 Parameterized Scopes: First-match prefix resolution allows permissive scope to shadow stricter scope
feature#50520 OID4VCI: Unbounded expire parameter on /create-credential-offer allows indefinite pre-auth codes oid4vc
feature#50999 Same-second refresh-token rotation allows stale token replay oidc
feature#51211 SAML: Add signature verification for inbound LogoutResponse messages saml
security#51699 Missing security headers on root-path redirect when http-relative-path is configured dist/quarkus
feature#52058 Add warning about dynamic urls to reflect the danger of hostname pollution docs
security#52642 SCIM user deletion skips security-state cleanup
security#52645 Bulk HQL executeUpdate bypasses AsyncCommitIntegrator security classification
feature#52691 Token exchange provider routing allows delegation tokens to bypass actor validation via standard exchange token-exchange
security#52696 Recovered sites can enforce stale security configuration for up to one hour storage
deprecated#44062 Should Kerberos Credential delegation be deprecated?
deprecated#51921 Deprecate legacy OIDC client switches from 'OpenID Connect Compatibility Modes' oidc
deprecated#52121 Deprecate volatile sessions and allow opting out of session caching
deprecated#52923 Deprecate 'Full scope allowed' client switch oidc
deprecated#53219 Deprecate other client registration providers than OIDC
breaking#51897 Deprecate route from AUTH_SESSION_ID cookie for sticky sessions
breaking#52130 Deprecate clusterless feature
breaking#52480 EOL Keycloak Realm Operator
feature#16738 Supported client secret rotation
feature#48899 SSF: Add support for RiscAccountPurged event ssf
feature#50644 [OID4VP] Support direct_post.jwt (encrypted) response mode authentication
feature#50876 update admin client tests to use sort and filter
feature#16947 group.spec.ts does not contain example of how to add attributes while creating groups admin/client-js
feature#22524 Improve WebAuthn error messages translations
security#52676 CVE-2026-4633 User enumeration via identity-first login when Organizations feature is enabled organizations
+331 more items in the release notessecurity#50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc
security#51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc
security#51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services
security#51281 [CVE-2026-18207] Source-group condition matches duplicate group names and can skip negative-logic enforcement oidc
security#51284 [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim oidc
security#51285 [CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains oidc
security#51781 [CVE-2026-18217] SAML Redirect Binding Parameter Pollution saml
security#52531 CVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependencies
security#52692 [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET oidc
security#52783 [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts (sibling of CVE-2026-9798) oidc
security#52888 CVE-2026-84939 org.freemarker:freemarker
security#52972 CVE-2026-8798 org.bouncycastle:bc-fips dependencies
security#52974 CVE-2026-13505 org.bouncycastle:bc-fips dependencies
security#53074 [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client token-exchange
feature#51340 DCR: Registration access token allows protocol switch from OIDC to SAML oidc
feature#52357 Upgrade to Quarkus 3.33.4 dist/quarkus
fix#50739 keycloak 26.7.0 sha1 file is missing dist/quarkus
fix#50903 Missing input length validation on username field causes outsized log generation in /login-actions/authenticate authentication
fix#51065 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested ci
fix#51067 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested ci
fix#51304 Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore. infinispan
fix#51761 PAR request URI lifespan is used as a hard cap on interactive login duration oidc
fix#51778 [quarkus-next] BouncyCastle 1.85 breaks SAML client creation when client ID exceeds 64 characters dist/quarkus
fix#52033 Improve retrieval of large read-only resources via admin API storage
fix#52088 New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts infinispan
fix#52153 DEBUG logging breaks persistent client session locking storage
fix#52193 Identity Provider Mappers - organization group targets do not resolve organizations
fix#52257 Event listeners receive the wrong event type when an EventBuilder is reused (e.g. FEDERATED_IDENTITY_LINK is logged and emailed as LOGIN) core
fix#52309 Admin Permissions filtering is applied to organization lookups during end-user authentication organizations
fix#52327 surefire-junit-platform not cached, causing intermittent test failures in CI ci
fix#52329 Flaky test: FlowTest.testRemoveExecutionSubflow fails with stale DELETE admin event testsuite
fix#52331 Flaky SCIM FilterTest.testFilterGroupsByMetaTimestamps due to same-millisecond timing saml
fix#52415 Flaky test: WebAuthnTransportLocaleTest.localizationTransportInternal fails with "Cannot logout user" testsuite
fix#52423 Flaky test: MySQLDistTest fails with "process hasn't exited" on slow CI runners testsuite
fix#52428 Flaky test: AttackDetectionResourceTest due to DefaultBlockingBruteForceProtector concurrent login blocking authentication
fix#52433 Flaky test: registration-policies.spec.ts kebab menu "Delete" item not found after toggle click testsuite
fix#52435 Flaky test: timeout.spec.ts fails with "fetch failed" due to server not ready and hardcoded port testsuite
fix#52460 Remove azure-cli version pin after runner image update removes apt source ci
fix#52487 Managing Identity Providers in the admin UI now requires client roles in the realm admin/ui
fix#52490 Flaky Admin UI E2E test: "Should show items on next page" in scope.spec.ts ci
+7 more items in the release notessecurity#52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
security#52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
security#52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
security#52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
security#52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
security#52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state
feature#52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus
fix#49635 Performance issue with 26.6.2 dist/quarkus
fix#51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci
fix#52015 New links errors for https://quarkus.io/guides docs
fix#52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan
fix#52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api
fix#52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus
fix#52241 Clicking on a sub group in the admin console throws an exception admin/ui
fix#52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite
fix#52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite
security#50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
security#50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
security#50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations
security#51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions
security#51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac
security#51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc
security#51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions
security#51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions
security#51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions
security#51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc
security#51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange
security#51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations
security#51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc
security#51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange
security#51378 [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions
security#51379 [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services
security#51380 [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc
security#51382 [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc
security#51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core
security#52028 [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc
other#50581 Admin API: User/group role-mapping endpoints disclose hidden client role metadata under FGAP v2 admin/fine-grained-permissions
fix#50825 Creating an organization without a domain leads to an error organizations
fix#50963 V1 token-exchange strips the DPoP sender-constraint from a bound access token token-exchange
fix#51510 SQLGrammarException: The incoming request has too many parameters core
fix#51523 Sustained high CPU on all nodes after upgrade admin/api
fix#51554 Admin API per-request cost grows super-linearly with realm count since 26.7.1 admin/api
fix#51589 NPE in RoleUtils.expandCompositeRoles when a cached client scope references a deleted role core
fix#51602 Invalid redirect on https://access.redhat.com/products/red-hat-single-sign-on/ docs
fix#51707 Lightweight access token role resolution resolves all roles across all realms on every admin API request core
fix#51712 Logout URL does not allow OIDC response parameters in its redirect_url oidc
fix#51780 SSSD CI job fails: FreeIPA container crashes on ubuntu-24.04 runner image 20260810.271 ci
fix#51785 Multiple CVEs inherited from Apache DS used for testing
fix#51790 Java Distribution IT/UT (windows-latest, temurin, 21) times out regularly ci
fix#51792 AsyncCommitIntegrator Aurora detection logs "ERROR: function aurora_version() does not exist" in the PostgreSQL server log on every startup
fix#51807 Client scope boundary bypassed when resolving admin roles via KeycloakIdentity admin/fine-grained-permissions
fix#51902 Index modifiers are not logged if an index is not created due to a threshold core
fix#51920 Error: 1020-HY000: Record has changed since last read in table OFFLINE_CLIENT_SESSION
fix#51983 [26.7.2] Regression in UI in JS keycloak-admin-client
security#52017 SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml
fix#52038 Client session note removals are not persisted with persistent user sessions core
+5 more items in the release notessecurity#49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies
security#50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions
security#50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix
security#50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions
security#51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc
security#51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client
security#51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass
other#50844 show-config prints the vault keystore password in cleartext dist/quarkus
feature#51344 Upgrade to Quarkus 3.33.3.1
fix#50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication
fix#50849 Correct SCIM name.formated scim
fix#50855 Rotated client secret remains valid when the feature is disabled oidc
fix#51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui
fix#51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core
fix#51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn
fix#51088 Verify email not working in incognito browser tab after Keycloak restart authentication
fix#51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core
fix#51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan
fix#51164 WebAuthn tests are being skipped in Github workflows workflows
fix#51182 Large HTTP/2 request headers are rejected with a bare 500 and no log; same request works over HTTP/1.1 dist/quarkus
fix#51323 Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 admin/rbac
fix#51331 Adding org member fails with 500 with stateless:v1 feature enabled organizations
fix#51407 The dist for Java API docs is empty docs
fix#51449 Incorrect query parameter name for "max"
fix#51476 Invalid link for https://www.ietf.org/rfc/rfc4559.txt docs
security#49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc
security#50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api
security#50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions
security#50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions
security#50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions
security#51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher
security#51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation
security#51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text
security#51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction
security#51471 CVE-2026-16443 SAML broker metadata import disables response signature validation
security#51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary
security#51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers
fix#50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn
fix#50750 Clustering test broken in 26.7 release branch ci
fix#50836 Kustomize cluster-wide faulty Role&RoleBinding operator
fix#50850 New Password is commited when multiple Password Reset is detected authentication
fix#50882 500 when client requests `organization` scope with it already set to `Default` authentication
fix#50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core
securityFixes CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
featureAutomate user provisioning with the SCIM API (preview)
featureSimplified multi-cluster high availability without external caches (preview)
featureEnhanced reverse proxy guides with blueprints for HAProxy and Traefik
featureStep-up authentication for SAML clients
securityClient-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.
securityConfidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.
securityOAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields.
securitySession-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions.
securityPolishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API.
securityLots of bugs fixed. Improved specification compliance.
securityConformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA).
securityManagement of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from…
securityPre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code
securitySupport for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults…
securityDocumentation updated and improved
featuremanage-organizations — grants full read and write access to organizations, including creating, updating, and deleting organizations and their members.
featureview-organizations — grants read-only access to organizations and their members (also requires view-users or Fine-Grained Admin Permissions for user visibility).
featurequery-organizations — grants the ability to search and list organizations without full view access, consistent with the query-users / query-clients / query-groups pattern.
security#49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles — realm-wide escalation from manage-clients admin/rbac
security#49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc
security#49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc
security#49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions
deprecated#49922 FreeMarker: deprecated no-arg Configuration constructor pins engine to legacy 2.3.0 defaults admin/ui
feature#50460 SSF push URL allow-list bypass via authority-attached wildcard ssf
breaking#44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering
breaking#48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated
breaking#49270 Remove the batching option for the persistent sessions
feature#9686 Store the Dynamic Scope parameter to avoid showing the Consent Screen every time there's an authentication
feature#20128 Add support for `reencrypt` OpenShift Routes to the Operator operator
feature#22042 More flexible imports in custom theme (i.e. CSS media queries) account/ui
feature#35650 Compatibility profiles
feature#44317 [OID4VCI] Add a client policy to require a credential offer
feature#46543 Step-up authentication for SAML - supported authentication
feature#48623 Make the admin client, from the admin-ui more easy to use
feature#9915 Make the consent screen text for dynamic scopes customizable with a reference to the dynamic scope parameter
feature#10696 Improve WebAuthn tests documentation testsuite
feature#12223 Dynamic scopes: requested scopes get mixed up between token requests oidc
feature#17758 [UX Review] Optimize the number box in the Time-policy creation page of client Authorization admin/ui
feature#17762 [UX Review] Optimize the initial page of Keys in OIDC client admin/ui
+317 more items in the release notes