8000 History for core - keycloak/keycloak · GitHub

Repository navigation

Commits

History for

Commits on Nov 6, 2026
- Validate ECDSA signature length before JWS verification (#53928)
  naruto-lgtm
  authored
  ea78b16
Commits on Oct 26, 2026
- fix: enforce the essential acr level when the flow finishes without a step-up
  
  michalvavrik
  authored and
  rmartinc
  committed
  791b93e
Commits on Oct 20, 2026
- Service account user ID available on client representation instead of exposing separate endpoint returning whole user representation
  
  vramik
  authored and
  pedroigor
  committed
  e203767
Commits on Oct 15, 2026
- Require https when dereferencing jwt vc issuer jwks_uri (#53763)
  naruto-lgtm
  authored
  a0f3020
Commits on Oct 7, 2026
- Organization API cannot restore an empty domain list from its GET representation
  
  vramik
  authored and
  pedroigor
  committed
  f770cbb
- Organization invitation redirectUrl is not validated against the account client allowlist, leaking a new user's authorization code
  
  vramik
  authored and
  pedroigor
  committed
  4c746a5
Commits on Oct 6, 2026
- Compare redirect URI hostnames case-insensitively (#52845)
  edewit
  authored
  b1bdd56
Commits on Sep 24, 2026
- Harden RSA1_5 JWE decryption against timing-based padding oracles
  
  hagerm98
  authored and
  mposolda
  committed
  8b678ae
Commits on Sep 22, 2026
- fix: keep resource_access claim when no entry can be converted
  
  waterWang
  authored and
  mposolda
  committed
  1fe42d2
Commits on Sep 18, 2026
- [OID4VCI] Prevent mappings of user-controlled data to sensitive claims (#52784)
  IngridPuppet
  authored
  1b536ef
Commits on Sep 16, 2026
- [OID4VCI]: fix selective disclosure for SD-JWT arrays (#52741)
  Awambeng
  authored
  14b4c98
Commits on Sep 14, 2026
- [OID4VCI] Conformance tests - support for mdl/mdoc, configuration cleanup. (#52624)
  
  lhanusov
  and
  dominikschlosser
  authored
  e08a678
Commits on Sep 9, 2026
- Multi-idp for orgs: REST API
  
  vramik
  authored and
  pedroigor
  committed
  32b207e
Commits on Sep 8, 2026
- Fix visibility for AZP in JsonWebToken
  ahus1
  authored
  9960642
- JpaOrganizationProvider and IdentityProviderStorageProvider support for idp-org relationship
  
  vramik
  authored and
  pedroigor
  committed
  932cee4
Commits on Sep 7, 2026
- Multi-IdP for orgs: Data Model
  
  vramik
  authored and
  pedroigor
  committed
  8fb918b
Commits on Aug 25, 2026
- [OpenID4VCI] Add support for mDoc format (#48095) (#48582)
  dominikschlosser
  authored
  6033aa3
- [OID4VP] Delegate trust material to an external trust IdP by alias
  
  dominikschlosser
  authored and
  rmartinc
  committed
  0c54fe8
Commits on Aug 20, 2026
- fix(core): make TokenUtil Jackson-agnostic
  
  michalvavrik
  authored and
  mposolda
  committed
  e0530ed
Commits on Aug 17, 2026
- [OID4VCI]: Fix JWT proof JWK claim type confusion causing proof validation failure (#50822)
  Awambeng
  authored
  14f4959
Commits on Aug 10, 2026
- [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users
  
  martin-kanis
  authored and
  pedroigor
  committed
  60967c8
Commits on Aug 7, 2026
- Fix admin roles assignments by protocol mappers for DCR (#957) (#51499)
  
  pskopek
  and
  mposolda
  authored
  467e908
Commits on Aug 5, 2026
- introduce a new keycloak admin client based on jackson 3 (#50848)
  michalvavrik
  authored
  c1cfde7
Commits on Jul 30, 2026
- [OID4VCI] User-editable did attribute used as credential subject with realm-local uniqueness only
  
  tdiesler
  authored and
  mposolda
  committed
  0ac222f
Commits on Jul 27, 2026
- [OID4VCI] Reject mismatched signature algorithms during SD-JWT verification (#51133)
  forkimenjeckayang
  authored
  ef25265
Commits on Jul 24, 2026
- [OID4VCI] Implement Key-Binding for jwt-credentials and fix it for SD-JWT (#49895)
  
  authored
  db820b2
Commits on Jul 23, 2026
- [OID4VP] Add support for direct_post.jwt response mode (#50932)
  dominikschlosser
  authored
  798dc35
Commits on Jul 16, 2026
- Manage null in BasicAuthHelper to avoid NPE
  rmartinc
  authored
  cfdd75f
Commits on Jul 14, 2026
- Initial implementation for Token Exchange Delegation provider
  rmartinc
  authored
  cfa7106
Commits on Jul 10, 2026
- [OID4VP] Initial verifier implementation (#50430)
  dominikschlosser
  authored
  7c03f32
Commits on Jul 7, 2026
- Create mapper for Token Exchange Delegation to create the may_act claim (#50427)
  
  mabartos
  and
  rmartinc
  authored
  7937224
Commits on Jul 3, 2026
- Configuration and defaults should honor long values (#50415)
  mabartos
  authored
  4536eab
Commits on Jul 2, 2026
- Control repeatability of parameterized client scopes (#50433)
  mabartos
  authored
  46ad7bd
Commits on Jun 30, 2026
- [OID4VCI-FAPI2] Pass fapi2-security-profile-final-refresh-token
  
  tdiesler
  authored and
  mposolda
  committed
  910b176
Commits on Jun 29, 2026
- use SHA384 for shaing for session cookies (#50296)
  gaoyikeshuer
  authored
  d829088

0