Repository navigation
Releases
26.3.5
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #41371 Upgrade to Quarkus 3.20.3 LTS
dist/quarkus - #41373 Remove explicit MariaDB connector dependency
dist/quarkus
Bugs
- #41418 Access to user details for restricted admin fails after enabling organizationin realm
organizations - #42405 Old hmac-generated (32bit) is recreated when order is changed in realm keys ui
core - #42491 CVE-2025-58057 - Netty BrotliDecoder / Data Amplification vulnerability
dist/quarkus - #42492 CVE-2025-58056 - Netty HTTP Request Smuggling vulnerability
dist/quarkus - #42736 Reset password in admin UI with 'not recently used' password policy leads to error 'Device already exists with the same name'
core - #42769 Missing switch "ID Token as detached signature" in the admin console client settings
oidc - #42922 Dynamic Client Registration invalidates the realm cache
core
26.3.4
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
Bugs
- #35825 Per client session idle time capped by realm level client idle timeout
core - #40374 Random but frequent duplicate key value violates unique constraint \"constraint_offl_us_ses_pk2\" errors
authentication - #40463 Login to Account Console produces two consecutive LOGIN events
account/ui - #40857 Unbounded login_hint Parameter Can Corrupt KC_RESTART Cookie and Break Login Flow
oidc - #41427 Parallel token exchange fails if client session is expired
token-exchange - #41801 Lack of coordination in database creation in 26.3.0 causes deployment failures (Reopen)
core - #41942 Uncaught server error: org.keycloak.models.ModelException: Database operation failed : Sync LDAP Groups to Keycloak (Custom Provider)
core - #42012 Client session timestamp not updated in the database if running multiple nodes
infinispan - #42046 KeycloakRealmImport placeholder replacement provides access to sensitive environment variables.
operator - #42158 Bug in configuration keycoak via keycloak.conf
dist/quarkus - #42164 [Keycloak CI - Docs] Broken links
core - #42178 Integer validation error not shown for user profile fields
user-profile - #42182 Validation errors for required actions don't show translated messages
admin/ui - #42270 Missing double-dash in the events documentation
core - #42339 Allowed Client Scopes add openid scope in scope list
oidc - #42369 Missing client session offline settings on realm level in the admin UI
admin/ui
26.3.3
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #41558 Ensure cache configuration has correct number of owners
- #41934 Infinispan 15.0.19.Final
- #41963 Upgrade to Quarkus 3.20.2.1
dist/quarkus
Bugs
- #39562 Breaking template change: Unknown `locale` input field added to user-profile registration page
user-profile - #40984 Backchannel logout token with an unexpected signature algorithm key
oidc - #41023 Can't send e-mails to international e-mail addresses: bad UTF-8 syntax
core - #41098 Locked out after upgrade to 26.3.1 due to missing sub in lightweight access token
core - #41268 `--optimized` flag and providers jar are incompatible when used with tools changing `last-modify-date`
dist/quarkus - #41290 Concurrent starts with JDBC_PING lead to a split cluster
infinispan - #41390 JDBC_PING2 doesn't merge split clusters after a while
infinispan - #41421 Broken link securing-cache-communication in caching docs
docs - #41423 Duplicate IDs in generated all configuration docs
docs - #41469 Uncaught exception cases unclosed spans in tracing
dist/quarkus - #41488 Synchronize Maven surefire plugin with Quarkus
dist/quarkus - #41491 ExternalLinks are broken in documentation
docs - #41520 LDAP Import: KERBEROS_PRINCIPAL not updated when UserPrincipal changes and KERBEROS_PRINCIPAL was null on creation
ldap - #41532 LDAP Sync all users takes unexpectedly long in 26.3 (> 30 min)
ldap - #41537 Getting error 405 "Method Not Allowed" when calling the "certs" endpoint with HEAD method
oidc - #41643 Test SMTP connection fails when no port is specified
admin/api - #41663 Typo in the caching doc
docs - #41677 Provider default regression
dist/quarkus - #41808 CVE-2025-7962 In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages
core - #41842 memberOf attribute empty or values with a DN that does not match the role base DN fetches all roles
ldap - #41906 Backwards incompatible changes to 26.3.0 cause NullPoointerException when requesting /certificates/jwt.credential/generate-and-download
authentication - #41945 After upgrade to 26.3: Not possible to use Credentials having not-unique label
login/ui
26.3.2
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
New features
- #40237 Add option "Requires short state parameter" to OIDC IDP
authentication
Enhancements
- #40970 Run clustering compatibility tests on release/x.y branches
- #41034 Improve logging for client sessions load
- #41257 Upgrade to Infinispan 15.0.18.Final
infinispan
Bugs
- #39091 Flaky test: org.keycloak.testsuite.cluster.JGroupsCertificateRotationClusterTest#testCoordinatorHasScheduleTask
ci - #39634 Update MariaDB connector to 3.5.3
dist/quarkus - #39854 Flaky test: org.keycloak.testsuite.cluster.PermissionTicketInvalidationClusterTest#crudWithFailover
ci - #40553 Upgrade org.postgresql:postgresql to version 42.7.7 to address CVE-2025-49146
dependencies - #40736 CVE-2025-49574 - Exposure of Resource to Wrong Sphere vulnerability in io.vertx:vertx-core
dependencies - #40782 Flaky test: org.keycloak.testsuite.cluster.RealmInvalidationClusterTest#crudWithFailover
ci - #40784 Default jdbc-ping cluster setup for distributed caches fails in Oracle
infinispan - #40977 Loglevel recorded from build phase
dist/quarkus - #40980 Can't update security-admin-console via admin UI with volatile sessions
infinispan - #40995 LDAP / ModelException: At least one condition should be provided to OR query
core - #41018 Flaky test: org.keycloak.testsuite.cluster.ClientInvalidationClusterTest#crudWithFailover
ci - #41038 FIPS errors in CI
- #41082 Multiple primary key defined when attempting to upgrade after 26.3.0
core - #41103 Service Account users now showing in the User List
admin/ui - #41105 Unknown relation when removing realm role with --db-schema configured
storage - #41152 Docs use em-dashes instead of double dashes for SPI options in regular text
docs - #41204 UpdateTest CI failures
ci - #41370 [26.3] MariaDB connector dependency is not properly overriden
dist/quarkus
26.3.1
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #40851 Upgrade to Infinispan 15.0.16.Final
- #40962 Update limitations of the preview feature rolling updates for patch releases
infinispan
Bugs
- #35932 Importing a realm takes more than 1 minute when multiple others exist.
dist/quarkus - #40368 NPE during loading user groups with concurrent deletion
storage - #40713 Unable to configure TLS reloading in Keycloak version 26.2.0 or later
account/api - #40838 Mark options for additional datasources as preview
dist/quarkus - #40890 Keycloak Operator 26.3.0 fails to update to 26.3.0
operator - #40930 Docs: server_development/topics/themes.adoc
docs - #40954 Keycloak 26.3.0 Regression: Failed to login if web-authn is disabled
core
26.3.0
Highlights
This release delivers advancements to optimize your system and improve the experience of users, developers and administrators:
-
Account recovery with 2FA recovery codes, protecting users from lockout.
-
Simplified experiences for application developers with streamlined WebAuthn/Passkey registration and simplified account linking to identity providers via application initiated actions.
-
Broader connectivity with the ability to broker with any OAuth 2.0 compliant authorization server, and enhanced trusted email verification for OpenID Connect providers.
-
Asynchronous logging for higher throughput and lower latency, ensuring more efficient deployments.
-
For administrators, experimental rolling updates for patch releases mean minimized downtime and smoother upgrades.
Read on to learn more about each new feature, and find additional details in the upgrading guide if you are upgrading from a previous release of Keycloak.
Recovering your account if you lose your 2FA credentials
When using for example a one-time-password (OTP) generators as a second factor for authenticating users (2FA), a user can get locked out of their account when they, for example, lose their phone that contains the OTP generator. To prepare for such a case, the recovery codes feature allows users to print a set of recovery codes as an additional second factor. If the recovery codes are then allowed as an alternative 2FA in the login flow, they can be used instead of the OTP generated passwords.
With this release, the recovery codes feature is promoted from preview to a supported feature. For newly created realms, the browser flow now includes the Recovery Authentication Code Form as Disabled, and it can be switched to Alternative by admins if they want to use this feature.
For more information about this 2FA method, see the Recovery Codes chapter in the Server Administration Guide.
Performance improvements to import, export and migration
The time it takes to run imports, exports or migrations involving a large number of realms has been improved. There is no longer a cumulative performance degradation for each additional realm processed.
Simplified registration for WebAuthn and Passkeys
Both WebAuthn Register actions (webauthn-register and webauthn-register-passwordless) which are also used for Passkeys now support a parameter skip_if_exists when initiated by the application (AIA).
This should make it more convenient to use the AIA in scenarios where a user has already set up WebAuthn or Passkeys. The parameter allows skipping the action if the user already has a credential of that type.
For more information, see the Registering WebAuthn credentials using AIA chapter in the Server Administration Guide.
Simplified linking of the user account to an identity provider
Client-initiated linking a user account to the identity provider is now based on application-initiated action (AIA) implementation. This functionality aligns configuring this functionality and simplifies the error handling the calling of the client application, making it more useful for a broader audience.
The custom protocol, which was previously used for client-initiated account linking, is now deprecated.
Brokering with OAuth v2 compliant authorization servers
In previous releases Keycloak already supported federation with other OpenID Connect and SAML providers, as well as with several Social Providers like GitHub and Google which are based on OAuth 2.0.
The new OAuth 2.0 broker now closes the gap to federate with any OAuth 2.0 provider. This then allows you to federate, for example, with Amazon or other providers. As this is a generic provider, you will need to specify the different claims and a user info endpoint in the provider’s configuration.
For more information, see the OAuth v2 identity providers chapter in the Server Administration Guide.
Trusted email verification when brokering OpenID Connect Providers
Until now, the OpenID Connect broker did not support the standard email_verified claim available from the ID Tokens issued by OpenID Connect Providers.
Starting with this release, Keycloak supports this standard claim as defined by the OpenID Connect Core Specification for federation.
Whenever users are federated for the first time or re-authenticating and if the Trust email setting is enabled, Sync Mode is set to FORCE and the provider sends the email_verified claim, the user account will have their email marked according to the email_verified claim.
If the provider does not send the claim, it defaults to the original behavior and sets the email as verified.
Asynchronous logging for higher throughput and lower latency
All available log handlers now support asynchronous logging capabilities. Asynchronous logging helps deployments that require high throughput and low latency.
For mor 8000 e details on this opt-in feature, see the Logging guide.
Rolling updates for patch releases for minimized downtime (preview)
In the previous release, the Keycloak Operator was enhanced to support performing rolling updates of the Keycloak image if both images contain the same version. This is useful, for example, when switching to an optimized image, changing a theme or a provider source code.
In this release, we extended this to perform rolling update when the new image contains a future patch release from the same major.minor release stream as a preview feature.
This can reduce the service’s downtime even further, as downtime is only needed when upgrading from a different minor or major version.
Read more on how to enable this feature in update compatibility command.
Passkeys integrated in the default username forms
In this release Keycloak integrates Passkeys in the default authentications forms. A new switch Enable Passkeys is available in the configuration, Authentication → Policies → Webauthn Passwordless Policy, that seamlessly incorporates passkeys support to the realm. With just one click, Keycloak offers conditional and modal user interfaces in the default login forms to allow users to authenticate with a passkey.
The Passkeys feature is still in preview. Follow the Enabling and disabling features guide to enable it.
For more information, see Passkeys section in the Server Administration Guide.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
New features
26.2.5
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #39469 Fix Securing Apps links to adapters
docs - #39486 Email server credentials can be harvested through host/port manipulation
admin/api - #39541 Fix doc link to FGAP v1
docs - #39543 Apply edits to Operators Guide
docs - #39572 Edit Observability Guide
docs - #39590 Fix callouts in Operator guide
docs - #39638 Sessions from Infinispan should be mapped lazily for the Admin UI
- #39651 Speed up Infinispan list of all sessions be more eagerly remove old client sessions
- #39665 When logging in, all client sessions are loaded which is slow
oidc
Bugs
- #39130 Authorization Code Flow Fails Scope Validation After Credential Definition Migration to Realm Level
oid4vc - #39157 [quarkus-next] TestEngine with ID 'junit-jupiter' failed to discover tests
dist/quarkus - #39264 [OID4VCI] Documentation Errors
docs - #39358 Aggregated policy: Cannot select policies that do not appear in the drop-down list
admin/ui - #39450 quarkus runtime options are treated as buildtime options
dist/quarkus - #39496 [26.2.3/26.1.5] Regression: empty ClientList in UI for Custom UserStorageProvider
admin/ui - #39499 UI does not show user's attributes after reentering the Attributes TAB
admin/ui - #39502 Refreshed tokens are not persisted for IDP token exchange
token-exchange - #39509 UI does not show organization's attributes after reentering the Attributes TAB
account/ui - #39538 Autocomplete in Mapper type of user federation broken
admin/ui - #39540 Forms IT tests breaks with Chrome 136.0.7103.59
ci - #39612 Unable to change the OTP hash algorithm
admin/ui - #39614 Keycloak not using custom Infinispan config
infinispan - #39663 Duplicate validation message “Please specify username.” shown on login form
login/ui - #39693 Clicking on the jump links removes the localization of the UI
admin/ui - #39697 Authorization documentation shows the wrong view
authorization-services - #39710 Recreate update is not scaling down the statefulset to zero
operator - #39724 Hibernate LazyInitializationException when deleting client with CompositeRoles
core - #39753 POST realm API returns 400 on conflict instead of 409 in version 26.2.4
admin/api - #39798 Documentation has outdated link to the "latest" branch of quickstarts
docs - #39800 [KEYCLOAK CI] - AuroraDB IT - Create EC2 runner instance
ci
26.2.4
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #39418 Clarify when to use podman
docs
Bugs
- #35278 Double click on social provider link causes page has expired error
login/ui - #38918 IPv6 support: Broker tests failing with proxy configuration
ci - #39021 After migrating to newer Keycloak, token refreshes using inherited offline sessions return access tokens with invalid exp value
oidc - #39023 Keycloak 26.2.0 UI Performance Degradation
admin/ui - #39173 duplicate key value violates unique constraint "constraint_offl_cl_ses_pk3"
infinispan - #39454 JGroups errors when running a containerized Keycloak in Strict FIPS mode and with Istio
infinispan - #39500 Update Job Pod is listed in the keycloak discovery service
operator
26.2.3
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
New features
- #38985 Possibility to log details and representation to the jboss-logging listener
Enhancements
- #39080 Standardize introductory text in Keycloak guides
Bugs
- #38104 Temporary failure in name resolution with nip.io
ci - #38145 Unknown error on authentication-flow delete action
admin/ui - #38482 SAML client certificate not persisted
admin/ui - #38487 [Keycloak Operator CI] - Test remote (slow) - UpdateTest.testExplicitStrategy
ci - #38660 Ldap federation seems to open and keep open a new thread/connection for each ldap request
ldap - #38671 Duplicate Key Violation When Reauthenticating After Account Deletion via Google
identity-brokering - #38703 Password Policy Changes get overwritten in the UI
admin/ui - #38799 Kerberos principal attribute value "comes back" when cleared.
admin/ui - #38873 Client Credentials tab : "Allow regex pattern comparison" toggle is always "On" on page load
admin/ui - #38911 Filtering of user- and admin-events by dateTo always returns empty results
admin/api - #38932 Home button always redirects to master realm when permission denied
admin/ui - #38934 UI: Readonly/disabled profile form input fields are visually indistinguishable from active fields
account/ui - #38964 [26.2.0/26.1.5] Regression: ClientList value is empty in UI for Custom UserStorageProviderFactory
admin/ui - #38970 Authentication request can fail with `unknown_error`
authentication - #39026 Fine-grained-permssion v2 Display problem
admin/fine-grained-permissions - #39037 UserInfo request fails by using an access token obtained in Hybrid flow with offline_access scope
oidc - #39046 Keycloak 26.2.0 can't authenticate to the H2 database after the upgrade
core - #39055 After import of keys an export doesn't include these values
admin/ui - #39065 Issue with SSL and `CertificatereloadManager` in Keycloak 26.2 when using Istio
infinispan - #39085 Redirects to admin endpoint 404s on hostname-admin / request scheme mismatch
core - #39124 [Operator CI] - Test remote (slow)
ci - #39180 Groups view: Filter/search bar disappears and groups not shown after clearing empty search results
admin/ui - #39182 Oracle driver problems in keycloak 26.2.1
dependencies - #39187 Account console: defaultLocale item in select locale field
account/ui - #39206 Wrong UDP jgroups metric name
docs - #39219 Serverinfo response grows over time
admin/api - #39237 Deletion of a role is slow when when there are a lot of roles in the database
core - #39246 Duplicate user entries when searching custom attributes
core - #39274 Aurora DB should not update automatically to the latest minor version
ci - #39296 Inconsistent "grant_types" vs "grantTypes" Naming Causes GrantTypeCondition to Always Fail
core - #39312 SLO measurement should mention a month as a period
docs
26.2.2
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Enhancements
- #39142 Make distribution startup timeout configurable
testsuite
Bugs
- #39125 [Keycloak CI] - FIPS UT - Run crypto tests
ci - #39349 CVE-2025-3910 Two factor authentication bypass
- #39350 CVE-2025-3501 Keycloak hostname verification