# Keycloak 26.4.6 released

DevFeed: [Keycloak 26.4.6 released](<https://devfeed.tech/articles/keycloak-26-4-6-released-31737.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/11/keycloak-2646-released>)

Author: Keycloak Team

Published: 2025-11-25T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [LDAP](<https://devfeed.tech/topics/ldap.md>), [Security](<https://devfeed.tech/topics/security.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>), [version](<https://devfeed.tech/topics/version.md>)

Tags: [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [version](<https://devfeed.tech/tags/version.md>)

## AI overview

Keycloak 26.4.6 adds default filtering of LDAP referrals, improving security and aligning with LDAP configuration best practices. The release also includes a security fix for deserialization of untrusted data in LDAP user federation and other resolved issues.

## Source excerpt

To download the release go to Keycloak downloads. Highlights This release adds filtering of LDAP referrals by default. This change enhances security and aligns with best practices for LDAP configurations. If you can not upgrade to this release yet, we recommend disabling LDAP referrals in all LDAP providers in all of your realms. For detailed upgrade instructions, review the upgrading guide. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation Bugs #43323 Sessions not removed when user is deleted infinispan #43738 UPDATE_EMAIL action invalidates old email login/ui #43754 Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest ci #43812 Admin console sends non-JSON payload with content-type: application/json admin/ui #44125 Double-encoding of query parameter values (e.g. acr_values) for version 26.4 identity-brokering #44187 [Keycloak Docs CI] Broken links docs #44189 [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry infinispan #44229 Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions infinispan #44269 Admin Client creates malformed paths for requests admin/client-js #44287 Caching of static theme resources in dev mode is disabled core