# Keycloak 26.5.5 released

DevFeed: [Keycloak 26.5.5 released](<https://devfeed.tech/articles/keycloak-26-5-5-released-31761.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/03/keycloak-2655-released>)

Author: Keycloak Team

Published: 2026-03-05T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [saml](<https://devfeed.tech/topics/saml.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [broker](<https://devfeed.tech/tags/broker.md>), [cve](<https://devfeed.tech/tags/cve.md>), [download](<https://devfeed.tech/tags/download.md>), [idm](<https://devfeed.tech/tags/idm.md>), [idp](<https://devfeed.tech/tags/idp.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [login](<https://devfeed.tech/tags/login.md>), [migration-guide](<https://devfeed.tech/tags/migration-guide.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.5.5 was released on March 5, 2026. The release includes security fixes for SAML broker authentication bypass, disabled identity provider enforcement, disabled SAML identity provider login, and encrypted assertion injection.

## Source excerpt

To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login #46912 CVE-2026-2092 saml broker encrypted assertion injection