VersionDrift
Product

Keycloak 26.8.0 → 26.8.2

2 releases · 0 breaking changes · 57 security fixes · 0 advisories fixed

57security0breaking0deprecated1feature22fix

Is 26.8.0 affected?

Breaking changes

None in the release notes.

Security changes

  • security #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations in 26.8.2
  • security #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication in 26.8.2
  • security #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc in 26.8.2
  • security #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication in 26.8.2
  • security #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus in 26.8.2
  • security #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count in 26.8.2
  • security #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1) in 26.8.2
  • security #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache) in 26.8.2
  • security #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint in 26.8.2
  • security #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint in 26.8.2
  • security #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName in 26.8.2
  • security #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307 in 26.8.2
  • security #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313 in 26.8.2
  • security #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289 in 26.8.2
  • security #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306 in 26.8.2
  • security #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292 in 26.8.2
  • security #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields in 26.8.2
  • security #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression) in 26.8.2
  • security #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration in 26.8.2
  • security #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response in 26.8.2
  • security #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290 in 26.8.2
  • security #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer in 26.8.2
  • security #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates in 26.8.2
  • security #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims in 26.8.2
  • security #54706 [CVE-2026-103112] Account Takeover via Authentication Race in 26.8.2
  • security #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover in 26.8.2
  • security #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation in 26.8.2
  • security #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve in 26.8.2
  • security #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256 in 26.8.2
  • security #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession in 26.8.2
  • security #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance in 26.8.2
  • security #54713 [CVE-2026-19688] Admin API missing audience check in 26.8.2
  • security #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user in 26.8.2
  • security #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering in 26.8.1
  • security #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc in 26.8.1
  • security #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering in 26.8.1
  • security #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
  • security #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions in 26.8.1
  • security #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication in 26.8.1
  • security #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api in 26.8.1
  • security #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services in 26.8.1
  • security #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services in 26.8.1
  • security #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc in 26.8.1
  • security #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication in 26.8.1
  • security #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions in 26.8.1
  • security #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication in 26.8.1
  • security #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api in 26.8.1
  • security #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard in 26.8.1
  • security #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability in 26.8.1
  • security #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies in 26.8.1
  • security #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies in 26.8.1
  • security #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication in 26.8.1
  • security #53582 Multiple CVEs in simple-git dependencies in 26.8.1
  • security #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui in 26.8.1
  • security #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api in 26.8.1
  • security #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions in 26.8.1
  • security #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication in 26.8.1

Every release in between

26.8.2 Nov 5, 2026 Release notes ↗
security#53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
security#53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
security#53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
security#53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
security#54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus
security#54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count
security#54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)
security#54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)
security#54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint
security#54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint
security#54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName
security#54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307
security#54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313
security#54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289
security#54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306
security#54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292
security#54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields
security#54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)
security#54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration
security#54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response
security#54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290
security#54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer
security#54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates
security#54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims
security#54706 [CVE-2026-103112] Account Takeover via Authentication Race
security#54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover
security#54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation
security#54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve
security#54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256
security#54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession
security#54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance
security#54713 [CVE-2026-19688] Admin API missing audience check
security#54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user
feature#54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus
fix#44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
fix#51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions
fix#52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
fix#52968 Much open UDP Sockets after some Time core
fix#53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core
fix#53507 Enhancement request suggestion in downstream documentation docs
+19 more items in the release notes
26.8.1 Oct 13, 2026 Release notes ↗
security#50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
security#51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
security#52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
security#53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
security#53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
security#53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
security#53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
security#53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
security#53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
security#53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
security#53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
security#53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
security#53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
security#53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
security#53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
security#53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
security#53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
security#53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
security#53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
security#53582 Multiple CVEs in simple-git dependencies
security#53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
security#53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api
security#53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
fix#51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
fix#52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
fix#52362 HttpServerUtil.sendResponse drops the headers it is given core
fix#52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
security#52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
fix#52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
fix#53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
fix#53142 Realm settings - security defenses admin/ui
fix#53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
fix#53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
fix#53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
fix#53505 Broken link to FIPS documentation docs
fix#53567 Broken link to vault documentation in downstream docs
fix#53569 Fix broken link to migrating the database in downstream docs
fix#53571 Broken link in Operator Guide docs
fix#53624 Multiple link issues including incorrect names and upstream only coding docs
fix#53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
+20 more items in the release notes
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status