# Keycloak changelog > Open-source identity and access management. - Vendor: Red Hat - Category: Developer Tools - Official site: https://www.keycloak.org - Tracked by: What's New (https://whatsnew.fyi/product/keycloak) - Harvested from: GitHub (keycloak/keycloak) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### 26.7.1 - Date: 2026-08-05 - Version: 26.7.1 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.7.1 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.7.1 - **security** — JWE request object bypasses requestObjectSignatureAlg enforcement - **security** — Privilege escalation via hardcoded role mapper injection in manage-clients - **security** — Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under FGAP v2 - **security** — Fine-Grained Admin Permissions Bypass in Client Scope Assignment - **security** — FGAP v2 parent group children endpoint bypasses per-child view permission filter - **fixed** — WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field - **fixed** — New Password is committed when multiple Password Reset is detected - **fixed** — 500 error when client requests organization scope with it already set to Default - **fixed** — IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

Bugs

### 26.7.0 - Date: 2026-07-09 - Version: 26.7.0 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.7.0 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.7.0 - **added** — Automate user provisioning with the SCIM API (preview) - **added** — Simplified multi-cluster high availability without external caches (preview) - **added** — Enhanced reverse proxy guides with blueprints for HAProxy and Traefik - **added** — Step-up authentication for SAML clients - **added** — Identity Brokering API V2 with client-level authorization, confidential client enforcement, OAuth 2.0 compliance, and session-based token storage - **deprecated** — Identity Brokering API V1 is deprecated and will be removed in a future release - **added** — Attestation based client authentication (ABCA) experimental feature via client-auth-abca flag - **added** — Management of verifiable credentials for individual users with administrator credential creation and user account console issuance - **added** — Support for credential refresh interval configuration in client scope settings with separate refresh interval control independent of credential lifetime - **added** — Pre-authorized code grant support moved to dedicated experimental feature oid4vc-vci-preauth-code - **changed** — Verifiable Credentials (OID4VCI) configuration is now fully configurable in the admin UI in addition to the admin REST API - **fixed** — Multiple bugs fixed in Verifiable Credentials (OID4VCI) functionality with improved specification compliance

Highlights

This release features new capabilities for users and administrators of Keycloak. The highlights of this release are:

Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide.

Security and Standards

Stronger security for the Identity Brokering API

The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design:

  • Client-level authorization — access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users.

  • Confidential clients only — public clients are rejected, ensuring that only authenticated clients can retrieve external tokens.

  • OAuth 2.0 compliant — the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields.

  • Session-based token storage — a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions.

V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default.

For more information, see the Identity Brokering APIs chapter in the Server Developer Guide.

Progress on Verifiable Credentials (OID4VCI) (experimental)

Verifiable Credentials (OID4VCI) allow organizations to issue tamper-proof, cryptographically signed credentials — such as employee badges, academic diplomas, or professional certifications — that users can store in a digital wallet and present to third parties without involving the issuer.

OID4VCI remains an experimental feature in Keycloak, but this release brings substantial improvements from both the core team and the community:

  • Polishing of existing functionality and improving configuration. Everything is now configurable in the admin UI in addition to the admin REST API.

  • Lots of bugs fixed. Improved specification compliance.

  • Conformance with the OpenID4VC High Assurance Interoperability Profile (HAIP). This _[Truncated at 4000 characters — full notes: https://github.com/keycloak/keycloak/releases/tag/26.7.0]_ ### 26.6.4 - Date: 2026-06-26 - Version: 26.6.4 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.6.4 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.6.4 - **security** — Fix group-admin escalation to realm-admin vulnerability - **security** — Fix information disclosure through arbitrary filesystem path probing vulnerability - **security** — Fix cross-site scripting (XSS) via case-insensitive URI validation bypass vulnerability - **security** — Fix attacker ability to re-enable and take over disabled clients via registration access token - **security** — Fix privilege escalation via improper scope mapping enforcement vulnerability - **security** — Fix unauthorized access to resources via UMA permission ticket bypass vulnerability - **security** — Fix policy enforcer authorization bypass via incorrect URI comparison vulnerability - **security** — Fix authentication bypass via JWT algorithm confusion vulnerability - **changed** — Upgrade to Quarkus 3.33.2.1

    Upgrading

    Before upgrading refer to the migration guide for a complete list of changes.

    All resolved issues

    Security fixes

    • #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
    • #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
    • #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
    • #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
    • #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
    • #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
    • #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison
    • #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion

    Enhancements

    • #50100 Upgrade to Quarkus 3.33.2.1

    Bugs

    • #47999 [Keycloak JavaScript CI] - Build Keycloak ci
    • #49639 Keycloak Admin Client tests fails in CI ci
    • #49700 Incorrect migration guide reference docs
    • #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan
    • #49733 keycloak-api-docs-dist is not deployable dist/quarkus
    ### 26.6.3 - Date: 2026-06-04 - Version: 26.6.3 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.6.3 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.6.3 - **security** — Fix CVE-2026-4800 lodash vulnerability to Code Injection via _.template imports key names in account/ui - **security** — Fix CVE-2026-4874 Server-Side Request Forgery via OIDC token endpoint manipulation - **security** — Fix CVE-2026-37977 CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint - **security** — Fix CVE-2026-7500 Improper Access Control on Keycloak Server when the Account API feature is disabled - **security** — Fix CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization - **security** — Fix CVE-2026-8922 OIDC token introspection ignores realm-level notBefore when client-level notBefore is set - **security** — Fix CVE-2026-8830 Missing server-side WebAuthn validations during credential registration - **security** — Fix CVE-2026-9088 Group Members Endpoint Bypasses User Profile Permissions - **security** — Fix CVE-2026-9087 Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login - **security** — Fix CVE-2026-9802 Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true - **security** — Fix CVE-2026-9794 SAML ECP faultstring discloses client existence and configuration state - **security** — Fix CVE-2026-9791 Organization data exposed in tokens and account API when Organizations feature is disabled at realm level - **security** — Fix CVE-2026-0707 ClientRegistrationAuth DoS via malformed Authorization header - **security** — Fix CVE-2026-9801 DoS in LDAP federation via malformed PasswordPolicyControl - **security** — Fix CVE-2026-9704 Privilege escalation via silent subject_token removal in token exchange - **security** — Fix CVE-2026-9792 ROPC grant bypass in client policy enforcement - **fixed** — Update UNSAFE_PATH_PATTERN regex to cover percent-encoded terminators and control characters - **fixed** — Fix NullPointerException in UMA permission grant when stale permission ticket references removed scope - **fixed** — Fix Account API Resource sharing endpoints to respect userManagedAccessAllowed realm setting - **fixed** — Fix Account resource sharing to resolve recipient by email before username to prevent granting access to wrong user

    Upgrading

    Before upgrading refer to the migration guide for a complete list of changes.

    All resolved issues

    Security fixes

    • #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui
    • #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc
    • #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services
    • #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api
    • #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
    • #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc
    • #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn
    • #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions
    • #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering
    • #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc
    • #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml
    • #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations
    • #49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api
    • #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap
    • #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc
    • #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc

    Weaknesses

    • #48978 UNSAFE_PATH_PATTERN regex to cover percent-encoded terminators and control characters oidc
    • #48986 Authorization Services: NullPointerException in UMA permission grant when stale permission ticket references removed scope authorization-services
    • #48987 Account API: Resource sharing endpoints ignore userManage _[Truncated at 4000 characters — full notes: https://github.com/keycloak/keycloak/releases/tag/26.6.3]_ ### 26.6.2 - Date: 2026-05-19 - Version: 26.6.2 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.6.2 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.6.2 - **security** — Fix HTTP/2 CONTINUATION Frame Flood Denial of Service (CVE-2026-33871) - **security** — Fix RFC violation HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing (CVE-2026-33870) - **security** — Fix improper access control on Keycloak Server through UMA resource management endpoints via PUT parameters (CVE-2026-4628) - **security** — Fix stored XSS in select-organization.ftl with insufficient FreeMarker HTML-escape in inline JS handler (CVE-2026-4048) - **security** — Fix use of broken or risky cryptographic algorithm vulnerability in bcpkix modules (CVE-2026-5588) - **security** — Fix acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration (CVE-2026-6856) - **security** — Fix multiple Bouncy Castle CVEs (CVE-2026-0636, CVE-2026-3505, CVE-2026-5598) - **security** — Fix denial of service when sending a crafted request to the /saml endpoint (CVE-2026-7307) - **security** — Fix redirect URI validation bypass (CVE-2026-7504) - **security** — Fix access token disclosure and implicit flow bypass via forged client data (CVE-2026-7571) - **security** — Fix session fixation in OIDC login flow leading to account takeover (CVE-2026-7507) - **security** — Fix execute-actions token replay allowing unauthorized WebAuthn credential enrollment on victim account (CVE-2026-37982) - **security** — Fix OIDC introspection endpoint not enforcing audience restriction, leaking claims from lightweight access tokens (CVE-2026-37979) - **security** — Fix cross-role PII leakage via evaluate-scopes endpoints bypassing user view permission (CVE-2026-37978) - **security** — Fix Keycloak Authorization Services Protection API IDOR (CVE-2026-4630) - **security** — Fix broken access control in Account Resources User Lookup allowing PII enumeration (CVE-2026-37981) - **fixed** — Allow duplicate user attribute values to be removed - **fixed** — Account UI no longer reports error when opening an unknown path - **fixed** — Realm import with --import-realm no longer fails with ModelValidationException when Admin Permissions is enabled - **changed** — Upgrade to Quarkus 3.33.1.1

      Upgrading

      Before upgrading refer to the migration guide for a complete list of changes.

      All resolved issues

      Security fixes

      • #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service
      • #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing
      • #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services
      • #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations
      • #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core
      • #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn
      • #48570 [CVE‐2026‐0636, CVE‐2026‐3505, CVE‐2026‐5598] Multiple bouncycastle CVEs core
      • #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint
      • #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak
      • #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data
      • #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover
      • #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account
      • #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens
      • #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission
      • #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access)
      • #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration

      Enhancements

      • #47728 Monitor backups for CNPG - describe how to monitor it in the CNPG for backups installation guide
      • #47734 Add dedicated "Monitoring Standbys" section to the general installation documentation
      • #48329 JDBC_PING in 26.6 should not fail with 26.7 schema changes
      • #48348 Escape expressions in JS blocks in FTL pages
      • #486 _[Truncated at 4000 characters — full notes: https://github.com/keycloak/keycloak/releases/tag/26.6.2]_ ### 26.6.1 - Date: 2026-04-15 - Version: 26.6.1 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.6.1 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.6.1 - **security** — Fix CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling - **security** — Fix CVE-2026-4633 Keycloak user enumeration via identity-first login - **changed** — Update CloudNativePG to 1.29 - **added** — Add database data at rest encryption - **fixed** — Fix false session type of access token in offline_access refresh token flow with scope parameter without offline_access scope - **fixed** — Fix Operator flood logs with warnings in v26.6.0 - **fixed** — Fix inability to sync latest keycloak-admin-client to keycloak-client - **fixed** — Fix @keycloak/keycloak-admin-client installation failure in version 26.6.0 - **fixed** — Fix invalid package reference in keycloak-admin-ui - **fixed** — Fix MigrateTo26_6_0 modifying custom browser flows and breaking existing realm authentication - **fixed** — Fix user profile multiselect options not highlighted as selected in dropdown - **fixed** — Fix IdentityProviderAuthenticator infinite redirect loop when an IdP returns an error with kc_idp_hint - **fixed** — Fix typo in endpoint response text during bootstrap

        Upgrading

        Before upgrading refer to the migration guide for a complete list of changes.

        All resolved issues

        Security fixes

        • #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core
        • #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core

        Enhancements

        • #47839 Update CloudNativePG to 1.29
        • #47909 Database data at rest encryption

        Bugs

        • #47435 AuroraDB IT CI workflow not cleaning up databases testsuite
        • #47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail testsuite
        • #47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope oidc
        • #47827 az vm create fails with JSON parsing error ci
        • #47872 v26.6.0 Operator flood logs with warnings operator
        • #47889 Not possible to sync latest keycloak-admin-client to keycloak-client admin/client-java
        • #47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0 admin/client-js
        • #47905 invalid package reference in keycloak-admin-ui admin/ui
        • #47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication organizations
        • #47929 User profile multiselect options not highlighted as selected in dropdown admin/ui
        • #47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint identity-brokering
        • #48015 Missing explicit docs anchor for organizations docs
        • #48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap dist/quarkus
        ### 26.6.0 - Date: 2026-04-08 - Version: 26.6.0 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.6.0 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.6.0 - **added** — JWT Authorization Grant enabling external-to-internal token exchange using externally signed JWT assertions - **added** — Federated client authentication allowing clients to leverage existing credentials and eliminate the need to manage individual client secrets in Keycloak - **added** — Workflows enabling administrators to automate realm administrative tasks such as user and client lifecycle management - **added** — Support for zero-downtime patch releases allowing rolling updates within a minor release stream without service downtime - **added** — Keycloak Test Framework replacing the previous Arquillian-based solution - **changed** — JWT Authorization Grant promoted from preview to supported status - **changed** — Federated client authentication promoted to supported status including support for client assertions issued by external OpenID Connect identity providers and Kubernetes Service Accounts - **added** — New guide about Demonstrating Proof-of-Possession (DPoP) for OAuth 2.0 providing information on how to mitigate the risk of stolen tokens - **added** — Identity Brokering APIs V2 in preview improving the token retrieval endpoint - **added** — Step-up authentication for SAML in preview mode extending step-up authentication to include the SAML protocol and clients - **added** — Experimental support for OAuth Client ID Metadata Document (CIMD) allowing Keycloak to serve as an authorization server for Model Context Protocol version 2025-11-25 or later

        Highlights

        This release features new capabilities for users and administrators of Keycloak. The highlights of this release are:

        • JWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions.

        • Federated client authentication, eliminating the need to manage individual client secrets in Keycloak.

        • Workflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management.

        • Zero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime.

        • The Keycloak Test Framework, replacing the previous Arquillian-based solution.

        All of these features are now fully supported and no longer in preview. Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide.

        Security and Standards

        JWT Authorization Grant (supported)

        JWT Authorization Grant (RFC 7523) is designed to implement external-to-internal token exchange use cases. This grant allows using externally signed JWT assertions to request OAuth 2.0 access tokens.

        In this release, JWT Authorization Grant is promoted from preview to supported. See the JWT Authorization Grant guide for additional details.

        Federated client authentication (supported)

        Federated client authentication allows clients to leverage existing credentials once a trust relationship with another issuer exists. It eliminates the need to assign and manage individual secrets for each client in Keycloak.

        Federated client authentication is now promoted to supported, including support for client assertions issued by external OpenID Connect identity providers and Kubernetes Service Accounts.

        Since the OAuth SPIFFE Client Authentication specification is still in draft status, this feature remains a preview feature in Keycloak.

        New guide about Demonstrating Proof-of-Possession (DPoP)

        A new guide for OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) in the Securing applications Guides provides information on how to mitigate the risk of stolen tokens by making tokens sender-constrained.

        See Securing applications with DPoP for more details.

        Identity Brokering APIs V2 (preview)

        A new preview version 2 for the Identity Brokering APIs is introduced in this release. When brokering is used during the authentication process, Keycloak allows you to store tokens and responses issued by the external Identity Provider. Applications can call a specific endpoint to retrieve those tokens, which, in turn, can be used to get extra user information or invoke endpoints in the external trust domain. The new version improves the token retrieval endpoint to substitute the internal to external Token Exchang _[Truncated at 4000 characters — full notes: https://github.com/keycloak/keycloak/releases/tag/26.6.0]_ ### 26.5.7 - Date: 2026-04-02 - Version: 26.5.7 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.5.7 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.5.7 - **security** — Fix improper access control in Admin REST API that leads to information disclosure - **security** — Fix static handler component cache manipulation vulnerability in vertx-core that can deny access to static files - **security** — Fix improper access control for level of assurance during credential deletion in account API - **security** — Fix application-level denial of service vulnerability via scope processing - **security** — Fix UMA policy resource injection vulnerability that allows unauthorized cross-user permission grants - **security** — Fix redirect URI validation bypass via path traversal in OIDC auth endpoint - **security** — Fix privilege escalation vulnerability via forged authorization codes due to SingleUseObjectProvider isolation flaw - **changed** — Upgrade to Quarkus 3.27.3 - **fixed** — Fix uncaught error when call is made without Host header

        Upgrading

        Before upgrading refer to the migration guide for a complete list of changes.

        All resolved issues

        Security fixes

        • #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api
        • #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files
        • #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api
        • #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing
        • #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
        • #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
        • #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

        Enhancements

        • #46631 Upgrade to Quarkus 3.27.3 dist/quarkus

        Bugs

        • #45204 Call without Host header throws uncaught error core
        ### 26.5.6 - Date: 2026-03-19 - Version: 26.5.6 - Original notes: https://github.com/keycloak/keycloak/releases/tag/26.5.6 - Permalink: https://whatsnew.fyi/product/keycloak/releases/26.5.6 - **security** — Fix Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri - **security** — Fix Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition - **security** — Fix Keycloak IDOR in realm client creating/deleting - **security** — Fix Keycloak Admin REST API Improper Access Control leads to sensitive role metadata information disclosure - **security** — Fix privilege escalation via manage-clients permission - **security** — Fix information disclosure via improper role enforcement in UMA 2.0 Protection API - **security** — Fix information disclosure of disabled user attributes via administrative endpoint - **security** — Fix authorization bypass allowing unprivileged tokens to enumerate user organization memberships - **fixed** — Fix federated user disabled when external DB unavailable never re-enabled - **fixed** — Fix AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication - **fixed** — Fix UsersResource.search briefRepresentation started to return user attributes - **fixed** — Fix unexpected error when logging out with offline session and external IDP - **fixed** — Fix operator-built DB config targetServerType=primary not applied and connection validation not working after master-replica failover - **fixed** — Fix partial LDAP sync duration does not follow the defined value in user federation - **fixed** — Fix startup regression with many realms RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm in O(N²) - **fixed** — Fix JGroups bind port configuration ignored when --cache-embedded-network-bind-port set - **fixed** — Fix SPIFFE Client assertion throws a NullPointerException if no client is found - **fixed** — Do not allow fetching organizations of a member if not a member of the current organization

        Upgrading

        Before upgrading refer to the migration guide for a complete list of changes.

        All resolved issues

        Security fixes

        • #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc
        • #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc
        • #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting
        • #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure
        • #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission
        • #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core
        • #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile
        • #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations

        Bugs

        • #45889 Federated user disabled when external DB unavailable, never re-enabled storage
        • #46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication
        • #46296 UsersResource.search briefRepresentation started to return user attributes admin/api
        • #46379 Unexpected error when logging out with offline session and external IDP oidc
        • #46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator
        • #46588 Partial LDAP sync duration does not follow the defined value in user federation ldap
        • #46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core
        • #46656 Em-Hyphens in SPI options on cache configuration page docs
        • #46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan
        • #46669 SPIFFE Client assertion throws a NullPointerException if no client is found token-exchange
        • #47079 Do not allow fetching organizations of a member if not a member of the current organization organizations
        ### nightly - Date: 2022-09-27 - Version: nightly - Original notes: https://github.com/keycloak/keycloak/releases/tag/nightly - Permalink: https://whatsnew.fyi/product/keycloak/releases/nightly - Labels: Pre-release; nightly