8000 Issues · keycloak/keycloak · GitHub

Repository navigation

Issues

Broken background and styling issues after post-upgrade version
task
keycloak/keycloak#55114 · opened on Nov 12, 2026 · 27.0 Release
Account: allow refusing removal of a user's last credential (passkey-only users can lock themselves out)
keycloak/keycloak#55110 · opened on Nov 12, 2026
Microsoft social provider: xms_edov missing — nOAuth-class account takeover via Entra common tenant
weakness
keycloak/keycloak#55109 · opened on Nov 12, 2026
Document that there is no integration between brokering and LoA
weakness
keycloak/keycloak#55108 · opened on Nov 12, 2026
[CIMD]: unauthenticated creation of service-account clients from the fetched metadata document
weakness
keycloak/keycloak#55106 · opened on Nov 12, 2026
1
[Quarkus 4] Retarget QOSDK checkout to next branch in quarkus-next workflow
task
keycloak/keycloak#55104 · opened on Nov 12, 2026
Remove unused UserSessionPersisterProvider#loadUserSessionsStream for startup and the 25.0.0 session migration
eol
keycloak/keycloak#55097 · opened on Nov 12, 2026
Remove deprecated AuthenticatedClientSessionModel#*CurrentRefreshToken* methods
eol
keycloak/keycloak#55096 · opened on Nov 12, 2026
Long IDP names do not wrap in Keycloak login buttons
bug
keycloak/keycloak#55093 · opened on Nov 12, 2026
Remove deprecated EntityDescriptorClientRegistrationProvider Client Registration Provider
task
keycloak/keycloak#55091 · opened on Nov 12, 2026
Upgrade to Quarkus 3.33.4.2
task
keycloak/keycloak#55087 · opened on Nov 12, 2026
[Keycloak 26.8.2] Admin Console login fails with Invalid parameter: redirect_uri on fresh Windows installation
bug
keycloak/keycloak#55076 · opened on Nov 12, 2026
1
OIDC identity provider claim filter ignores claims returned by the userinfo endpoint
keycloak/keycloak#55074 · opened on Nov 12, 2026
FGAP V2: setCredentialUserLabel allows type-agnostic relabeling with RESET_PASSWORD only
bug
keycloak/keycloak#55072 · opened on Nov 11, 2026
Security vulnerability report: Keycloak 26.8.1, anonymously registered clients skip the consent page with hidden scopes and mappers, so a signed-in user's code, name and e-mail (and a refresh token) go to the attacker
weakness
keycloak/keycloak#55071 · opened on Nov 11, 2026
1
Broker LogoutResponse uses RelayState as direct session ID without provider correlation
weakness
keycloak/keycloak#55070 · opened on Nov 11, 2026
Pairwise mapper sectorIdentifierUri bypasses client URI policies and triggers a server-side GET
weakness
keycloak/keycloak#55069 · opened on Nov 11, 2026
SAML adapter accepts assertion addressed to another ACS when outer Response Destination is absent
weakness
keycloak/keycloak#55068 · opened on Nov 11, 2026
Expired SAML metadata keys remain trusted after validity ends
weakness
keycloak/keycloak#55067 · opened on Nov 11, 2026
Expired Signed Request Objects Still Authorize Login
weakness
keycloak/keycloak#55066 · opened on Nov 11, 2026
Browser LogoutRequest bypasses SLO session ownership checks (incomplete fix of #53535)
weakness
keycloak/keycloak#55065 · opened on Nov 11, 2026
[CVE-2026-125652] Client-level mandatory PKCE is not applied to authorization codes from the login-actions entry point
cve
keycloak/keycloak#55064 · opened on Nov 11, 2026
Document and add a skill for writing Liquibase changelog entries that work for both automatic and manual migration
keycloak/keycloak#55057 · opened on Nov 11, 2026
Remove deprecated AdapterInstallationClientRegistrationProvider Client Registration Provider
task
keycloak/keycloak#55035 · opened on Nov 11, 2026
persian language is missing font and styling
enhancement
keycloak/keycloak#55023 · opened on Nov 11, 2026
1

0