Is Keycloak 26.2.3 affected?

May 5, 2025 · Release notes ↗

CVSS 8.8

25 known vulnerabilities affect 26.2.3 (highest CVSS 8.8).

Your branch 26.2 has reached end of life (Jul 2, 2025).

36 newer releases in its track, up to 26.8.1. What changed up to 26.8.1

Vulnerabilities affecting 26.2.3

8.8
CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation fixed in 26.4.14
8.1
CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher fixed in 26.4.14
8.1
CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers fixed in 26.4.14
8.1
CVE-2026-9800 Authorization bypass via incorrect uri comparison fixed in 26.6.4
8.1
CVE-2026-11800 Authentication bypass via jwt algorithm confusion fixed in 26.6.4
7.7
CVE-2026-9099 group-admin escalation to realm-admin fixed in 26.6.4
7.7
CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions fixed in 26.2.14
7.5
CVE-2025-11419 Keycloak TLS Client-Initiated Renegotiation Denial of Service fixed in 26.2.10
7.4
CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction fixed in 26.4.14
7.4
CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation fixed in 26.4.14
7.3
CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass fixed in 26.6.4
7.3
CVE-2026-9795 Privilege escalation via improper scope mapping enforcement fixed in 26.6.4
6.8
CVE-2025-11538 Debug default bind address fixed in 26.4.4
6.5
CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text fixed in 26.6.5
6.5
CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token fixed in 26.6.4
5.5
CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation fixed in 26.2.11
5.4
CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary fixed in 26.4.14
5.3
CVE-2025-8419 Keycloak SMTP Inject Vulnerability fixed in 26.2.8
4.9
CVE-2026-9083 Information disclosure through arbitrary filesystem path probing fixed in 26.6.4
4.9
CVE-2025-9162 Variable resolution on imports can expose environment variables fixed in 26.2.9
4.6
CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass fixed in 26.6.4
4.3
CVE-2025-10044 Keycloak error_description injection on error pages that can trigger phishing attacks fixed in 26.2.9
3.7
CVE-2025-10939 Unable to restrict access to the admin console fixed in 26.4.4
medium
CVE-2025-7784 Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled) fixed in 26.2.6
medium
CVE-2025-7365 Phishing attack via email verification step in first login flow fixed in 26.2.6

Newer releases

26.8.1	Oct 13, 2026	26.2.3 → 26.8.1
26.8.0	Oct 1, 2026	26.2.3 → 26.8.0
26.7.5	Sep 30, 2026	26.2.3 → 26.7.5
26.7.4	Sep 16, 2026	26.2.3 → 26.7.4
26.7.3	Aug 31, 2026	26.2.3 → 26.7.3
26.7.2	Aug 19, 2026	26.2.3 → 26.7.2
26.7.1	Aug 5, 2026	26.2.3 → 26.7.1
26.7.0	Jul 9, 2026	26.2.3 → 26.7.0
26.6.4	Jun 26, 2026	26.2.3 → 26.6.4
26.6.3	Jun 4, 2026	26.2.3 → 26.6.3
26.6.2	May 19, 2026	26.2.3 → 26.6.2
26.6.1	Apr 15, 2026	26.2.3 → 26.6.1
26.6.0	Apr 8, 2026	26.2.3 → 26.6.0
26.5.7	Apr 2, 2026	26.2.3 → 26.5.7
26.5.6	Mar 19, 2026	26.2.3 → 26.5.6