26.7.2
Changed 1
- Upgrade to Quarkus 3.33.3.1
Fixed 11
- Fixed password denylist false positive warning on startup with large pre-computed bloom file
- Corrected SCIM name.formated field
- Fixed rotated client secret remaining valid when the feature is disabled
- Fixed invalid redirect URI on logout from pages with sub-tab hash fragments
- Fixed parameterized UserPropertyMapper exposing target user attributes without permission check
- Fixed passkey icons using wrong color variant when realm disables dark mode
- Fixed verify email not working in incognito browser tab after Keycloak restart
- Fixed warning about proactive closing of session being missed in TransactionSessionHandler logic
- Fixed upgrade to 26.7.0 failing with preview features when stateless cluster provider captures null NodeInfo before postInit
- Fixed custom realm-level role named admin not being updatable in non-master realms after Keycloak 26.7.0
- Fixed adding org member failing with 500 error when stateless:v1 feature is enabled
Security 8
- Fixed CVE-2026-45292 OpenTelemetry Java SDK unbounded memory allocation in W3C Baggage Propagation
- Fixed CVE-2026-14613 fine-grained admin permissions bypass via role groups endpoint
- Fixed CVE-2026-59888 and CVE-2026-59889 by upgrading jackson-databind to 2.21.5
- Fixed CVE-2026-15945 group hierarchy search disclosure of hidden parent groups under fine-grained admin permissions v2
- Fixed CVE-2026-17048 admin REST API leaking vault-resolved rotated client secrets
- Fixed CVE-2026-15571 predictable account-linking hash enabling account takeover via malicious OIDC client
- Fixed CVE-2026-18963 unauthenticated account takeover via reset-credentials flow bypass
- Fixed show-config command printing vault keystore password in cleartext
From Keycloak