8000 Releases · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Releases

26.8.2

26.8.2 Latest
Latest

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 05 Nov 16:00
26.8.2
e514445

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
  • #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
  • #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
  • #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
  • #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus
  • #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count
  • #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)
  • #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)
  • #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint
  • #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint
  • #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName
  • #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307
  • #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313
  • #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289
  • #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306
  • #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292
  • #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields
  • #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)
  • #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration
  • #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response
  • #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290
  • #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer
  • #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates
  • #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims
  • #54706 [CVE-2026-103112] Account Takeover via Authentication Race
  • #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover
  • #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation
  • #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve
  • #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256
  • #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession
  • #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance
  • #54713 [CVE-2026-19688] Admin API missing audience check
  • #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

Weaknesses

  • #50917 Realm client-session stats disclose hidden clients under FGAP v2 admin/fine-grained-permissions
  • #52104 JWE key-management algorithm not validated against provisioned key algorithm on request object decryption oidc
  • #53210 Harden PathMatcher URI normalization for leading dot segments and authority-less schemes authorization-services
  • #53535 SAML SLO: unsigned client can impersonate victim SP via spoofed Issuer on back-channel SessionIndex logout saml
  • #53815 Unverified broker email can satisfy an organization domain gate identity-brokering

Enhancements

  • #54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

Bugs

  • #44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
  • #51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions
  • #52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
  • #52968 Much open UDP Sockets after some Time core
  • #53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core
  • #53507 Enhancement request suggestion in downstream documentation docs
  • #53510 Github discussion reference should only be upstream docs
  • #53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core
  • #53634 IdentityBrokerService fires duplicate error events and reflects user input in responses identity-brokering
  • #53760 Concurreny issue in JAXPValidationUtil saml
  • #53804 Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN operator
  • #53809 ISPN000427 timeout on distributed caches when entry lock is contended during topolog...
Read more
Assets 22

nightly

nightly Pre-release
Pre-release

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 27 Sep 02:22
nightly
30cf683
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
Update AGENTS.md with contribution conventions

Closes #54657

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Loading

26.8.1

26.8.1

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 13 Oct 08:58
26.8.1
24ed1da

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
  • #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
  • #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
  • #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
  • #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
  • #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
  • #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
  • #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
  • #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
  • #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
  • #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
  • #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
  • #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
  • #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
  • #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
  • #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
  • #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
  • #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
  • #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
  • #53582 Multiple CVEs in simple-git dependencies
  • #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
  • #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api

Weaknesses

  • #49009 DockerEndpoint does not validate invalidRequestMessage after parsing authorization request oidc
  • #49786 Organizations: Invitation link can be used by multiple users due to missing single-use check organizations
  • #51312 refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation oidc
  • #51887 Username enumeration via empty-password timing authentication
  • #52063 Ensure max consumed respone size is respected for OCSP and CRLs authentication
  • #52680 Kerberos TRACE logging records complete SPNEGO credentials authentication
  • #52982 Non-critical X.509 KeyUsage mismatch bypasses authentication policy authentication
  • #52984 SimpleHttpResponse connection pool leak in identity brokering flows identity-brokering
  • #53079 Dynamic client registration self-enables privileged SSF event access oidc
  • #53116 SAML SLO: unauthenticated arbitrary session termination via LogoutRequest (SessionIndex) saml
  • #53354 SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering
  • #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
  • #53430 Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener) storage
  • #53494 SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check core
  • #53693 FGAP v2: non-imported LDAP users returned in search results for query-users-only delegated admins admin/fine-grained-permissions

Bugs

  • #51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
  • #52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
  • #52362 HttpServerUtil.sendResponse drops the headers it is given core
  • #52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
  • #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
  • #52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
  • #53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
  • #53142 Realm settings - security defenses admin/ui
  • #53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
  • #53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
  • #53471 Regression with Trust Email when the ...
Read more
Loading

26.8.0

26.8.0

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 01 Oct 05:57
26.8.0
4246609

Highlights

This release features new capabilities for users and administrators of Keycloak. The highlights of this release are:

  • Issue and verify digital wallet credentials with OID4VCI and OID4VP

  • Automate user provisioning across identity systems with the SCIM API

  • Run multi-cluster deployments without an external cache using stateless mode (now supported)

  • Simpler administration with automatic index creation, reduced memory usage, and enhanced HTTP performance

  • Token exchange delegation for AI agents and automation with consent and FGAP authorization

Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide.

Security and Standards

Verifiable Credential Issuance promoted to preview with credential management and revocation

The OpenID for Verifiable Credential Issuance (OID4VCI) feature has been promoted from experimental to preview. It can now be enabled with --features=preview or --features=oid4vc-vci.

Credential lifecycle management now includes revocation when refresh tokens are revoked, and a new Application Initiated Action (AIA) lets users request credential issuance within an authenticated session. Key attestation is configurable in the admin console with hardened x5c certificate validation following the HAIP profile. This release also adds experimental support for the mdoc format, provided by the new experimental feature oid4vc-mdoc. Integration guides for the Lissi and Valera wallets are available, along with documentation for SD-JWT signing key setup, credential management, and revocation.

Example applications are provided in this release (for illustration, not officially supported):

The attestation-based client authentication (client-auth-abca), pre-authorized code grant (oid4vc-vci-preauth-code), REST credential offer endpoint (oid4vc-vci-rest-credential-offer), and OpenID4VP (oid4vc-vp) remain experimental features.

Verify credentials with OID4VP (experimental)

Organizations adopting verifiable credentials need a way to accept credential presentations from digital wallets as part of login flows, without requiring a traditional password.

Keycloak can now act as an OID4VP verifier, enabling authentication flows where users present verifiable credentials from their wallets. The verifier supports cross-device presentation flows and the direct_post.jwt encrypted response mode. Trust material for credential verification can be delegated to an external identity provider by alias, and SD-JWT User Attribute and Session mappers are available to extract claims from presented credentials.

Thanks to Dominik Schlosser for this contribution.

React to account status changes with Shared Signals Framework (experimental)

The experimental Shared Signals Framework (SSF) support now emits RISC account-disabled and account-enabled event types when a user is enabled or disabled, extending coverage beyond the CAEP session and credential events that shipped in 26.7. Additionally, the event structure has been revised for better alignment with the CAEP and RISC specifications, and the admin event store no longer receives unvalidated payloads to prevent PII leakage.

For more details, see the Shared Signals Framework guide.

Parameterized (formerly dynamic) scopes preview support (preview)

Parameterized scopes (formerly known as dynamic scopes) allow clients to pass a parameter value along with the scope name in an OAuth 2.0 authorization request. This is especially useful when a scope represents an entity with a large or dynamic set of values (for example a project name like project:12345), preventing the need to pre-define countless individual client scopes in Keycloak.

Parameterized scopes have officially moved from experimental to preview status.

For more details about the feature, see the Server Administration Guide.

Token exchange delegation with consent, FGAP authorization, and audit trail (preview)

Applications such as AI agents and automation tools need limited, consent-based access to act on behalf of a user without requiring administrator privileges or exposing sensitive credentials.

Users can now delegate access to a client application through OAuth consent using the new delegation:client:<client-id> parameterized scope. The resulting token includes an act claim identifying the client as the actor. Unlike admin-user delegation, client delegation does not grant Admin API access even if the client holds service account credentials, ensuring that a leaked delegation token cannot escalate privileges. The delegation:user and delegation:client client scopes are now auto-created as Optional scopes in all realms, and delegation authorization is controlled exclusively through Fine-Grained Admin Permissions V2 using the delegate and delegate-members scopes. Delegation audit events now include the client identity, and standard token exchange rejects subject tokens carrying delegation claims to prevent bypass. A new client policy executor allows administrators to restrict the may_act claim in access tokens, giving per-client control over which clients can participate in delegation.

Token exchange delegation support status is now preview.

For more details, see the Token exchange delegation section.

Track impersonation across token lifecycle and downstream services

When an administrator impersonates a user, downstream resource servers and audit systems had no reliable way to identify that a token was issued under impersonation or who the impersonator was.

Token lifecycle events (CODE_TO_TOKEN, REFRESH_TOKEN, and others) are now enriched with impersonator ...

Read more

Contributors

context
Loading

26.7.5

26.7.5

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 30 Sep 17:44
26.7.5
44299f3

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

Weaknesses

  • #51340 DCR: Registration access token allows protocol switch from OIDC to SAML oidc
  • #53024 check-licenses.sh: shell injection via source of dependency pom.properties

Enhancements

  • #52357 Upgrade to Quarkus 3.33.4 dist/quarkus

Bugs

  • #50739 keycloak 26.7.0 sha1 file is missing dist/quarkus
  • #50903 Missing input length validation on username field causes outsized log generation in /login-actions/authenticate authentication
  • #51065 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested ci
  • #51067 Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested ci
  • #51304 Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore. infinispan
  • #51761 PAR request URI lifespan is used as a hard cap on interactive login duration oidc
  • #51778 [quarkus-next] BouncyCastle 1.85 breaks SAML client creation when client ID exceeds 64 characters dist/quarkus
  • #52033 Improve retrieval of large read-only resources via admin API storage
  • #52088 New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts infinispan
  • #52153 DEBUG logging breaks persistent client session locking storage
  • #52193 Identity Provider Mappers - organization group targets do not resolve organizations
  • #52257 Event listeners receive the wrong event type when an EventBuilder is reused (e.g. FEDERATED_IDENTITY_LINK is logged and emailed as LOGIN) core
  • #52309 Admin Permissions filtering is applied to organization lookups during end-user authentication organizations
  • #52327 surefire-junit-platform not cached, causing intermittent test failures in CI ci
  • #52329 Flaky test: FlowTest.testRemoveExecutionSubflow fails with stale DELETE admin event testsuite
  • #52331 Flaky SCIM FilterTest.testFilterGroupsByMetaTimestamps due to same-millisecond timing saml
  • #52415 Flaky test: WebAuthnTransportLocaleTest.localizationTransportInternal fails with "Cannot logout user" testsuite
  • #52423 Flaky test: MySQLDistTest fails with "process hasn't exited" on slow CI runners testsuite
  • #52428 Flaky test: AttackDetectionResourceTest due to DefaultBlockingBruteForceProtector concurrent login blocking authentication
  • #52433 Flaky test: registration-policies.spec.ts kebab menu "Delete" item not found after toggle click testsuite
  • #52435 Flaky test: timeout.spec.ts fails with "fetch failed" due to server not ready and hardcoded port testsuite
  • #52460 Remove azure-cli version pin after runner image update removes apt source ci
  • #52487 Managing Identity Providers in the admin UI now requires client roles in the realm admin/ui
  • #52490 Flaky Admin UI E2E test: "Should show items on next page" in scope.spec.ts ci
  • #52493 AuroraDB IT - Create EC2 runner instance fails: RHEL 9.4 AMI deregistered ci
  • #52712 WebAuthnPolicyComplianceTest.replayedCredentialRegistration is flaky due to missing sync point authentication
  • #52716 Flaky CI: junit-jupiter-engine not in Maven cache causes transient test failures ci
  • #52868 Flaky test: RecoveryAuthnCodesAuthenticatorTest#test07SetupRecoveryAuthnCodes on Chrome testsuite
  • #53054 ServerConfigClassOrderer comparator violates Comparable contract causing flaky CI failures testsuite
  • #53069 Format string mismatches in logging statements cause silent argument loss and potential MissingFormatArgumentException core
Loading

26.7.4

26.7.4

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 16 Sep 14:44
26.7.4
aa9fe3f

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
  • #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
  • #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
  • #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
  • #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
  • #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state

Enhancements

  • #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus

Bugs

  • #49635 Performance issue with 26.6.2 dist/quarkus
  • #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci
  • #52015 New links errors for https://quarkus.io/guides docs
  • #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan
  • #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api
  • #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus
  • #52241 Clicking on a sub group in the admin console throws an exception admin/ui
  • #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite
  • #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite
Loading

26.7.3

26.7.3

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 31 Aug 09:29
26.7.3
6d238b6

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
  • #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
  • #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations
  • #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions
  • #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac
  • #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc
  • #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions
  • #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions
  • #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions
  • #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc
  • #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange
  • #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations
  • #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bc) inspects only the query string, not the URL fragment oidc
  • #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange
  • #51378 [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions
  • #51379 [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services
  • #51380 [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc
  • #51382 [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc
  • #51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core
  • #52028 [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc

Weaknesses

  • #50581 Admin API: User/group role-mapping endpoints disclose hidden client role metadata under FGAP v2 admin/fine-grained-permissions
  • #50583 Admin API: Composite role endpoints do not filter child roles by FGAP v2 view permission admin/fine-grained-permissions
  • #50990 Admin UI extension effective-role endpoints disclose hidden composite roles admin/fine-grained-permissions
  • #51143 Aggregate policy partial evaluation diverges from runtime semantics under FGAP v2 admin/fine-grained-permissions
  • #51144 Partial evaluation misses ancestor group policies with extendChildren admin/fine-grained-permissions
  • #51202 Client-protocol condition can be bypassed on admin client creation by omitting protocol oidc

Bugs

  • #50825 Creating an organization without a domain leads to an error organizations
  • #50963 V1 token-exchange strips the DPoP sender-constraint from a bound access token token-exchange
  • #51510 SQLGrammarException: The incoming request has too many parameters core
  • #51523 Sustained high CPU on all nodes after upgrade admin/api
  • #51554 Admin API per-request cost grows super-linearly with realm count since 26.7.1 admin/api
  • #51589 NPE in RoleUtils.expandCompositeRoles when a cached client scope references a deleted role core
  • #51602 Invalid redirect on https://access.redhat.com/products/red-hat-single-sign-on/ docs
  • #51707 Lightweight access token role resolution resolves all roles across all realms on every admin API request core
  • #51712 Logout URL does not allow OIDC response parameters in its redirect_url oidc
  • #51780 SSSD CI job fails: FreeIPA container crashes on ubuntu-24.04 runner image 20260810.271 ci
  • #51785 Multiple CVEs inherited from Apache DS used for testing
  • #51790 Java Distribution IT/UT (windows-latest, temurin, 21) times out regularly ci
  • #51792 AsyncCommitIntegrator Aurora detection logs "ERROR: function aurora_version() does not exist" in the PostgreSQL server log on every startup
  • #51807 Client scope boundary bypassed when resolving admin roles via KeycloakIdentity admin/fine-grained-permissions
  • #51902 Index modifiers are not logged if an index is not created due to a threshold core
  • #51920 Error: 1020-HY000: Record has changed since last read in table OFFLINE_CLIENT_SESSION
  • #51983 [26.7.2] Regression in UI in JS keycloak-admin-client
  • #52017 SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml
  • #52038 Client session note removals are not persisted with persistent user sessions core
Loading

26.7.2

26.7.2

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 19 Aug 05:26
26.7.2
289376b

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

Weaknesses

  • #50844 show-config prints the vault keystore password in cleartext dist/quarkus

Enhancements

  • #51344 Upgrade to Quarkus 3.33.3.1

Bugs

  • #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication
  • #50849 Correct SCIM name.formated scim
  • #50855 Rotated client secret remains valid when the feature is disabled oidc
  • #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui
  • #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core
  • #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn
  • #51088 Verify email not working in incognito browser tab after Keycloak restart authentication
  • #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core
  • #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan
  • #51164 WebAuthn tests are being skipped in Github workflows workflows
  • #51182 Large HTTP/2 request headers are rejected with a bare 500 and no log; same request works over HTTP/1.1 dist/quarkus
  • #51323 Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 admin/rbac
  • #51331 Adding org member fails with 500 with stateless:v1 feature enabled organizations
  • #51407 The dist for Java API docs is empty docs
  • #51449 Incorrect query parameter name for "max"
  • #51476 Invalid link for https://www.ietf.org/rfc/rfc4559.txt docs
Loading

26.7.1

26.7.1

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 05 Aug 15:54
26.7.1
73f08b3

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc
  • #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api
  • #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions
  • #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions
  • #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions
  • #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher
  • #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation
  • #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text
  • #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction
  • #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation
  • #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary
  • #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers

Bugs

  • #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn
  • #50750 Clustering test broken in 26.7 release branch ci
  • #50836 Kustomize cluster-wide faulty Role&RoleBinding operator
  • #50850 New Password is commited when multiple Password Reset is detected authentication
  • #50882 500 when client requests `organization` scope with it already set to `Default` authentication
  • #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core
Loading

26.7.0

26.7.0

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 09 Jul 06:58
26.7.0
6c73e30

Highlights

This release features new capabilities for users and administrators of Keycloak. The highlights of this release are:

  • Automate user provisioning with the SCIM API (preview)

  • Simplified multi-cluster high availability without external caches (preview)

  • Enhanced reverse proxy guides with blueprints for HAProxy and Traefik

  • Step-up authentication for SAML clients

Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide.

Security and Standards

Stronger security for the Identity Brokering API

The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design:

  • Client-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.

  • Confidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.

  • OAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields.

  • Session-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions.

V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default.

For more information, see the Identity Brokering APIs chapter in the Server Developer Guide.

Progress on Verifiable Credentials (OID4VCI) (experimental)

Verifiable Credentials (OID4VCI) allow organizations to issue tamper-proof, cryptographically signed credentials — such as employee badges, academic diplomas, or professional certifications — that users can store in a digital wallet and present to third parties without involving the issuer.

OID4VCI remains an experimental feature in Keycloak, but this release brings substantial improvements from both the core team and the community:

  • Polishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API.

  • Lots of bugs fixed. Improved specification compliance.

  • Conformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This work involves the introduction of the dedicated Keycloak experimental feature client-auth-abca for Attestation based client authentication (ABCA).

  • Management of verifiable credentials for individual users. This involves the ability for an administrator to create a verifiable credential for a user to indicate that this user can retrieve a verifiable credential, as well as the ability for users to start issuance of a verifiable credential from the Keycloak account console.

  • Pre-authorized code grant support is still experimental and was moved to the dedicated experimental feature oid4vc-vci-preauth-code

  • Support for credential refresh interval. Administrators can now configure a separate refresh interval (vc.refresh_interval_in_seconds) in the client scope settings that controls how often wallets must refresh the credential, independent of the credential lifetime. When not explicitly set, defaults to 7 days or the credential lifetime, whichever is smaller. This enables regular credential rotation for enhanced security while maintaining user convenience through automatic refresh using the refresh token. For more information, see the Create Client Scopes with Mappers section in the OID4VCI configuration guide.

  • Documentation updated and improved

Cross-domain token exchange with Identity Assertion JWT Grant (experimental)

When two organizations each run their own authorization server, users often need to re-authenticate when crossing between them — even though their identity was already verified. The Identity Assertion JWT Authorization Grant (ID-JAG) solves this by allowing one authorization server to present a signed identity assertion to another, which then issues an access token without requiring the user to log in again.

Keycloak provides partial experimental support for the Identity Assertion JWT Authorization Grant. It currently implements only the receiving authorization server role, accepting ID-JAG assertions at the token endpoint and issuing access tokens in return. Other parts of the ID-JAG specification are not yet implemented, so the complete flow is not currently supported.

To try it out, start Keycloak with the feature identity-assertion-jwt enabled.

Many thanks to Yutaka Obuchi for the contribution of this feature!

Automate user provisioning with the SCIM API (preview)

SCIM (System for Cross-domain Identity Management) is a standard protocol for reading and writing identity resources such as users and groups across multiple systems. It enables organizations to automate user provisioning and deprovisioning using widely available tooling — for example, integrating with identity governance platforms, HR systems, or other identity providers.

Keycloak has SCIM APIs for managing users and groups within a realm. The implementation covers full CRUD and PATCH operations, filtering and pagination, schema extensions including the Enterprise User extension, and schema discovery endpoints.

In this release, the SCIM API is being promoted to a preview feature. In the default profile it is disabled by default; to try it out, enable the scim-api feature.

For more details, see the Managing users and groups through SCIM documentation.

Real-time security signals to downstream applications (experimental)

When a user logs out, changes credentials, or gets disabled in Keycloak, downstream applications typically don’t learn about it until the next token refresh — leaving a window where stale sessions remain active. The

Read more
Loading
0