# Keycloak 26.5.3 released

DevFeed: [Keycloak 26.5.3 released](<https://devfeed.tech/articles/keycloak-26-5-3-released-31755.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/02/keycloak-2653-released>)

Author: Keycloak Team

Published: 2026-02-10T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>), [migration](<https://devfeed.tech/topics/migration.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Mocha](<https://devfeed.tech/topics/mocha.md>), [Quarkus](<https://devfeed.tech/topics/quarkus.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Hibernate](<https://devfeed.tech/topics/hibernate.md>), [YAML](<https://devfeed.tech/topics/yaml.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [ci](<https://devfeed.tech/tags/ci.md>), [hibernate](<https://devfeed.tech/tags/hibernate.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [migration](<https://devfeed.tech/tags/migration.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [quarkus](<https://devfeed.tech/tags/quarkus.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [yaml](<https://devfeed.tech/tags/yaml.md>)

## AI overview

Keycloak 26.5.3 is a February 10, 2026 release that includes security fixes for JWT authorization grants, invitation JWTs, identity-provider ownership checks, and other resolved issues.

## Source excerpt

To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ Enhancements #45892 Upgrade minikube for CI tests operator Bugs #44379 Node.js admin client does not refresh tokens admin/client-js #45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus #45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus #45677 Hibernate Validator is enabled by default when not used dist/quarkus #45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite #45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci #45755 Broken YAML indentation in operator rolling updates doc docs #45780 Remove fatal log messages from `ConsistentHash`