Repository navigation

Commits

History for

on26.7.3

Commits on Aug 31, 2026
- Set version to 26.7.3
  github-actions[bot]
  committed
  6d238b6
Commits on Aug 28, 2026
- Check consento for JWT Authorization Grant
  
  graziang
  authored and
  mposolda
  committed
  3aa7902
Commits on Aug 27, 2026
- [CVE-2026-16089] Authorization codes can be retargeted to another client session closes #51003
  mposolda
  committed
  48f8661
- Filter stale role IDs in Infinispan client adapters
  
  ahus1
  and
  PRAHLAD09-dev
  authored
  28d95cd
Commits on Aug 26, 2026
- Persist client session note removals with persistent user sessions
  
  authored
  3add94b
- fix client nbf bypass
  
  graziang
  authored and
  mposolda
  committed
  d89dbfb
- [Backport 26.7] Skip resolving roles when processing transient tokens on FGAP requests (#51772)
  
  pedroigor
  and
  waterWang
  authored
  9ed8eb1
Commits on Aug 25, 2026
- Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed
  mposolda
  committed
  d7427ce
Commits on Aug 24, 2026
- Client access-type condition evaluates updates against the old client type
  mposolda
  committed
  1812b4b
Commits on Aug 21, 2026
- Client-protocol condition can be bypassed on admin client creation by omitting protocol
  mposolda
  committed
  f7df458
- Normalize again in JavaKeystoreKeyProviderFactory validation of the path
  rmartinc
  authored
  1d0af52
Commits on Aug 20, 2026
- Generic identity-provider creation can bind brokers to organizations without manage-organizations (#51817)
  
  pedroigor
  and
  vramik
  authored
  aa3224e
- GET /roles/{role}/users returns user PII without the per-user view filter with FGAP V1 (#51823)
  
  pedroigor
  and
  vramik
  authored
  cc84bb0
- Incorrect authorization in admin role-composite deletion - delegated admin removes privileged child roles it cannot map (#51825)
  
  pedroigor
  and
  vramik
  authored
  d711d63
- Authenticator config surfaces expose raw reCAPTCHA secrets (#51827)
  
  pedroigor
  and
  vramik
  authored
  643cb8a
- Partial evaluation misses ancestor group policies with extendChildren
  
  pedroigor
  and
  vramik
  authored
  04027da
- Admin API: Composite role endpoints do not filter child roles by FGAP v2 view permission
  
  martin-kanis
  authored and
  pedroigor
  committed
  6a7ef71
- Enforce membership permission when creating users
  pedroigor
  authored
  bc9a9f3
- Admin API: User/group role-mapping endpoints disclose hidden client role metadata under FGAP v2
  
  martin-kanis
  authored and
  pedroigor
  committed
  34c3f1b
- Admin UI extension effective-role endpoints disclose hidden composite roles
  
  martin-kanis
  authored and
  pedroigor
  committed
  59984a6
Commits on Aug 19, 2026
- [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints
  martin-kanis
  authored
  23c020b
- [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2
  martin-kanis
  authored
  9353149
Commits on Aug 10, 2026
- Allow members to be added to organizations
  ahus1
  authored
  fa22fa4
Commits on Aug 6, 2026
Commits on Jul 24, 2026
- Fix admin roles assignments by protocol mappers for DCR (#957)
  mposolda
  authored
  439195e
Commits on Jul 17, 2026
- Make sure admin role checks are based on the actual roles granted to the user
  
  sguilhen
  and
  pedroigor
  authored
  200e655
Commits on Jul 16, 2026
- FGAP v2 parent group children endpoint bypasses per-child view permission filter
  vramik
  authored
  5684c92
- Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under FGAP v2
  vramik
  authored
  a8acabe

Breadcrumbs

User selector

Datepicker

Commit history

Commits on Aug 31, 2026

Commits on Aug 28, 2026

Commits on Aug 27, 2026

Commits on Aug 26, 2026

Commits on Aug 25, 2026

Commits on Aug 24, 2026

Commits on Aug 21, 2026

Commits on Aug 20, 2026

Commits on Aug 19, 2026

Commits on Aug 10, 2026

Commits on Aug 6, 2026

Commits on Jul 24, 2026

Commits on Jul 17, 2026

Commits on Jul 16, 2026