8000 Commits · keycloak/keycloak · GitHub

Repository navigation

Commits

Commits on Aug 19, 2026
- Set version to 26.7.2
  github-actions[bot]
  committed
  289376b
Commits on Aug 11, 2026
- Use model ID to set the AUTHENTICATION_SELECTOR_SCREEN_DISPLAYED auth note (#986)
  rmartinc
  authored
  289dcdc
- CVE-2026-15571 Disable legacy client-initiated account linking (26.7) (#955)
  graziang
  authored
  8d465ac
Commits on Aug 10, 2026
- fix: correcting the query param name (#51457) (#51555)
  shawkins
  authored
  f9b4178
- Allow members to be added to organizations
  ahus1
  authored
  fa22fa4
Commits on Aug 7, 2026
- fix(tests-51164): Adds conditional evaluation to WebAuthn workflow config
  
  rmartinc
  and
  mbijon
  authored
  20e6e77
Commits on Aug 6, 2026
- Change rfc4559 link to datatracker as other links
  rmartinc
  authored
  9163d2f
- Parameterized UserPropertyMapper exposes target user attributes without permission check (#51063) (#51207)
  mabartos
  authored
  79311a2
- fix: allows verify email working in incognito browser tab after Keycloak restart (#51089) (#51259)
  
  rmartinc
  and
  pchorus
  authored
  5a04efb
- Fine-Grained Admin Permissions Bypass via Role Groups Endpoint
  vramik
  authored
  6947a1b
- Fix warning when loading pre-computed password denylist with duplicates
  kfaseela
  authored
  8151d79
- fix(admin/api): allow non-master realm roles named admin or create-realm
  
  pedroigor
  and
  alehhu
  authored
  a77fe89
- Fix stateless cluster and db migrations race
  slaskawi
  authored
  3de2f91
- MCP Authorization specification 2026-07-28
  tnorimat
  authored
  9bcc875
- Group hierarchy search discloses hidden parent groups under FGAP v2
  
  pedroigor
  and
  vramik
  authored
  fbb3184
- Document protocol mappers and 'Allow access to user data' switch
  mabartos
  authored
  02b6a1a
- Passkey icons use wrong color variant when realm disables dark mode
  mabartos
  authored
  de684ae
- Correct SCIM name.formated (#51028)
  
  cgeorgilakis
  and
  cgeorgilakis-grnet
  authored
  2eb257d
- Rotated client secret remains valid when the feature is disabled (#50910) (#51302)
  
  mabartos
  and
  rmartinc
  authored
  91ca85b
- [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets (#51209) (#51300)
  mabartos
  authored
  8885c2b
- fix: removing the message about missing proactive closure (#51251) (#51267)
  shawkins
  authored
  849b66d
- Mask vault password in show-config (#51013) (#51149)
  
  shawkins
  and
  AkashKumar7902
  authored
  feb7d69
- CVE-2026-45292: size-limiting baggage propagator wrapper (#51099)
  Pepo48
  authored
  7a1bba4
- Invalid redirect URI on logout from pages with sub-tab hash fragments (#51055) (#51056)
  mabartos
  authored
  a41812a
- Fix JavaDoc dist (#51408) (#51416)
  vmuzikar
  authored
  12d3ac2
- Upgrade to Quarkus 3.33.3 (#51346)
  Pepo48
  authored
  5b97b5a
- Upgrade to Infinispan 16.0.14
  ruchikajha95
  authored
  1c0d9a4
- Align the HTTP/2 max header list size with the HTTP/1.1 max header size (#51397)
  
  shawkins
  and
  thejamesgore
  authored
  506df74
Commits on Jul 24, 2026
Commits on Jul 23, 2026
- CVE-2026-16100 Prevent OOM via request-controlled error text metrics explosion (26.7) (#946)
  ahus1
  authored
  9ede910
Commits on Jul 22, 2026
- Normalize URI in PathMatcher to prevent authorization bypass via mutated paths (#933)
  sguilhen
  authored
  7faf572

0