26.7.3
Security 20
- Fix LDAP client implementation certificate hostname verification
- Fix required signed-JWT assertion policy bypass with unsigned assertion headers
- Fix organization managers creating managed members through stored registration links without manage-users permission
- Fix realm default-group reads disclosing hidden groups under FGAP v2
- Fix missing per-role authorization on RoleContainerResource composite endpoints
- Fix authorization codes being retargeted to another client session
- Fix authenticator config surfaces exposing raw reCAPTCHA secrets
- Fix incorrect authorization in admin role-composite deletion allowing delegated admin to remove privileged child roles
- Fix GET /roles/{role}/users returning user PII without per-user view filter
- Fix client not-before revocation being ignored when realm not-before is older but nonzero
- Fix Microsoft external access-token exchange bypassing configured tenant
- Fix generic identity-provider creation binding brokers to organizations without manage-organizations
- Fix redirect_uri OIDC response-parameter injection by checking URL fragment not only query string
- Fix Google external access-token exchange bypassing hosted-domain restriction
- Fix FGAP V2 group assignment bypass during user creation allowing adding unpermitted groups
- Fix UMA claim token overriding authorization time-policy clock
- Fix client access-type condition evaluating updates against old client type
- Fix full-scope-disabled client policy validation bypass by omitting fullScopeAllowed
- Fix relative path traversal enabling filesystem probing in path handling
- Fix jwt-bearer authorization grant not enforcing consentRequired
From Keycloak