Keycloak 26.8.1 → 26.8.2

1 release · 0 breaking changes · 33 security fixes · 0 advisories fixed

33security0breaking0deprecated1feature6fix

Is 26.8.1 affected?

Breaking changes

None in the release notes.

Security changes

security #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations in 26.8.2
security #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication in 26.8.2
security #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc in 26.8.2
security #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication in 26.8.2
security #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus in 26.8.2
security #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count in 26.8.2
security #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1) in 26.8.2
security #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache) in 26.8.2
security #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint in 26.8.2
security #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint in 26.8.2
security #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName in 26.8.2
security #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307 in 26.8.2
security #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313 in 26.8.2
security #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289 in 26.8.2
security #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306 in 26.8.2
security #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292 in 26.8.2
security #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields in 26.8.2
security #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression) in 26.8.2
security #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration in 26.8.2
security #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response in 26.8.2
security #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290 in 26.8.2
security #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer in 26.8.2
security #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates in 26.8.2
security #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims in 26.8.2
security #54706 [CVE-2026-103112] Account Takeover via Authentication Race in 26.8.2
security #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover in 26.8.2
security #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation in 26.8.2
security #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve in 26.8.2
security #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256 in 26.8.2
security #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession in 26.8.2
security #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance in 26.8.2
security #54713 [CVE-2026-19688] Admin API missing audience check in 26.8.2
security #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user in 26.8.2

Every release in between

26.8.2 Nov 5, 2026 Release notes ↗

security#53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations

security#53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication

security#53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc

security#53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication

security#54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus

security#54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count

security#54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)

security#54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)

security#54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint

security#54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint

security#54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName

security#54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307

security#54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313

security#54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289

security#54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306

security#54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292

security#54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields

security#54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)

security#54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration

security#54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response

security#54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290

security#54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer

security#54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates

security#54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims

security#54706 [CVE-2026-103112] Account Takeover via Authentication Race

security#54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover

security#54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation

security#54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve

security#54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256

security#54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession

security#54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance

security#54713 [CVE-2026-19688] Admin API missing audience check

security#54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

feature#54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

fix#44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication

fix#51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions

fix#52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export

fix#52968 Much open UDP Sockets after some Time core

fix#53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core

fix#53507 Enhancement request suggestion in downstream documentation docs

+19 more items in the release notes