Keycloak

Developer Tools

Open-source identity and access management.

Latest 26.7.1 · by Red HatWebsitekeycloak/keycloak

Release activity

Release activity — 9 releases across 9 days in the last year. Each cell is one day; darker means more releases that day. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 19, 2026No releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026
MondayNo releases on Apr 20, 2026No releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026
TuesdayNo releases on Apr 21, 2026No releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 20261 release on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026
WednesdayNo releases on Apr 22, 2026No releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 20261 release on Aug 5, 2026
ThursdayNo releases on Apr 23, 2026No releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 20261 release on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 20261 release on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on Apr 24, 2026No releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 20261 release on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on Apr 25, 2026No releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026

9 releases in the last year

Changelog

26.7.1

Fixed 4
  • WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field
  • New Password is committed when multiple Password Reset is detected
  • 500 error when client requests organization scope with it already set to Default
  • IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion
Security 5
  • JWE request object bypasses requestObjectSignatureAlg enforcement
  • Privilege escalation via hardcoded role mapper injection in manage-clients
  • Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under FGAP v2
  • Fine-Grained Admin Permissions Bypass in Client Scope Assignment
  • FGAP v2 parent group children endpoint bypasses per-child view permission filter
View originalPermalink
How 26.7.1 went

26.7.0

Added 9
  • Automate user provisioning with the SCIM API (preview)
  • Simplified multi-cluster high availability without external caches (preview)
  • Enhanced reverse proxy guides with blueprints for HAProxy and Traefik
  • Step-up authentication for SAML clients
  • Identity Brokering API V2 with client-level authorization, confidential client enforcement, OAuth 2.0 compliance, and session-based token storage
  • Attestation based client authentication (ABCA) experimental feature via client-auth-abca flag
Changed 1
  • Verifiable Credentials (OID4VCI) configuration is now fully configurable in the admin UI in addition to the admin REST API
Fixed 1
  • Multiple bugs fixed in Verifiable Credentials (OID4VCI) functionality with improved specification compliance
Deprecated 1
  • Identity Brokering API V1 is deprecated and will be removed in a future release
View originalPermalink
How 26.7.0 went

26.6.4

Changed 1
  • Upgrade to Quarkus 3.33.2.1
Security 8
  • Fix group-admin escalation to realm-admin vulnerability
  • Fix information disclosure through arbitrary filesystem path probing vulnerability
  • Fix cross-site scripting (XSS) via case-insensitive URI validation bypass vulnerability
  • Fix attacker ability to re-enable and take over disabled clients via registration access token
  • Fix privilege escalation via improper scope mapping enforcement vulnerability
  • Fix unauthorized access to resources via UMA permission ticket bypass vulnerability
  • Fix policy enforcer authorization bypass via incorrect URI comparison vulnerability
  • Fix authentication bypass via JWT algorithm confusion vulnerability
View originalPermalink
How 26.6.4 went

26.6.3

Fixed 4
  • Update UNSAFE_PATH_PATTERN regex to cover percent-encoded terminators and control characters
  • Fix NullPointerException in UMA permission grant when stale permission ticket references removed scope
  • Fix Account API Resource sharing endpoints to respect userManagedAccessAllowed realm setting
  • Fix Account resource sharing to resolve recipient by email before username to prevent granting access to wrong user
Security 16
  • Fix CVE-2026-4800 lodash vulnerability to Code Injection via _.template imports key names in account/ui
  • Fix CVE-2026-4874 Server-Side Request Forgery via OIDC token endpoint manipulation
  • Fix CVE-2026-37977 CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint
  • Fix CVE-2026-7500 Improper Access Control on Keycloak Server when the Account API feature is disabled
  • Fix CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
  • Fix CVE-2026-8922 OIDC token introspection ignores realm-level notBefore when client-level notBefore is set
View originalPermalink
How 26.6.3 went

26.6.2

Changed 1
  • Upgrade to Quarkus 3.33.1.1
Fixed 3
  • Allow duplicate user attribute values to be removed
  • Account UI no longer reports error when opening an unknown path
  • Realm import with --import-realm no longer fails with ModelValidationException when Admin Permissions is enabled
Security 16
  • Fix HTTP/2 CONTINUATION Frame Flood Denial of Service (CVE-2026-33871)
  • Fix RFC violation HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing (CVE-2026-33870)
  • Fix improper access control on Keycloak Server through UMA resource management endpoints via PUT parameters (CVE-2026-4628)
  • Fix stored XSS in select-organization.ftl with insufficient FreeMarker HTML-escape in inline JS handler (CVE-2026-4048)
  • Fix use of broken or risky cryptographic algorithm vulnerability in bcpkix modules (CVE-2026-5588)
  • Fix acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration (CVE-2026-6856)
View originalPermalink
How 26.6.2 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services
Microsoft-Activation-Scripts

Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

massgravel

Discussion