26.6.3
Fixed 4
- Update UNSAFE_PATH_PATTERN regex to cover percent-encoded terminators and control characters
- Fix NullPointerException in UMA permission grant when stale permission ticket references removed scope
- Fix Account API Resource sharing endpoints to respect userManagedAccessAllowed realm setting
- Fix Account resource sharing to resolve recipient by email before username to prevent granting access to wrong user
Security 16
- Fix CVE-2026-4800 lodash vulnerability to Code Injection via _.template imports key names in account/ui
- Fix CVE-2026-4874 Server-Side Request Forgery via OIDC token endpoint manipulation
- Fix CVE-2026-37977 CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint
- Fix CVE-2026-7500 Improper Access Control on Keycloak Server when the Account API feature is disabled
- Fix CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
- Fix CVE-2026-8922 OIDC token introspection ignores realm-level notBefore when client-level notBefore is set
- Fix CVE-2026-8830 Missing server-side WebAuthn validations during credential registration
- Fix CVE-2026-9088 Group Members Endpoint Bypasses User Profile Permissions
- Fix CVE-2026-9087 Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login
- Fix CVE-2026-9802 Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true
- Fix CVE-2026-9794 SAML ECP faultstring discloses client existence and configuration state
- Fix CVE-2026-9791 Organization data exposed in tokens and account API when Organizations feature is disabled at realm level
- Fix CVE-2026-0707 ClientRegistrationAuth DoS via malformed Authorization header
- Fix CVE-2026-9801 DoS in LDAP federation via malformed PasswordPolicyControl
- Fix CVE-2026-9704 Privilege escalation via silent subject_token removal in token exchange
- Fix CVE-2026-9792 ROPC grant bypass in client policy enforcement