26.6.1
Added 1
- Add database data at rest encryption
Changed 1
- Update CloudNativePG to 1.29
Fixed 9
- Fix false session type of access token in offline_access refresh token flow with scope parameter without offline_access scope
- Fix Operator flood logs with warnings in v26.6.0
- Fix inability to sync latest keycloak-admin-client to keycloak-client
- Fix @keycloak/keycloak-admin-client installation failure in version 26.6.0
- Fix invalid package reference in keycloak-admin-ui
- Fix MigrateTo26_6_0 modifying custom browser flows and breaking existing realm authentication
- Fix user profile multiselect options not highlighted as selected in dropdown
- Fix IdentityProviderAuthenticator infinite redirect loop when an IdP returns an error with kc_idp_hint
- Fix typo in endpoint response text during bootstrap
Security 2
- Fix CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling
- Fix CVE-2026-4633 Keycloak user enumeration via identity-first login