26.5.6
Fixed 10
- Fix federated user disabled when external DB unavailable never re-enabled
- Fix AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication
- Fix UsersResource.search briefRepresentation started to return user attributes
- Fix unexpected error when logging out with offline session and external IDP
- Fix operator-built DB config targetServerType=primary not applied and connection validation not working after master-replica failover
- Fix partial LDAP sync duration does not follow the defined value in user federation
- Fix startup regression with many realms RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm in O(N²)
- Fix JGroups bind port configuration ignored when --cache-embedded-network-bind-port set
- Fix SPIFFE Client assertion throws a NullPointerException if no client is found
- Do not allow fetching organizations of a member if not a member of the current organization
Security 8
- Fix Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri
- Fix Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition
- Fix Keycloak IDOR in realm client creating/deleting
- Fix Keycloak Admin REST API Improper Access Control leads to sensitive role metadata information disclosure
- Fix privilege escalation via manage-clients permission
- Fix information disclosure via improper role enforcement in UMA 2.0 Protection API
- Fix information disclosure of disabled user attributes via administrative endpoint
- Fix authorization bypass allowing unprivileged tokens to enumerate user organization memberships