# Keycloak 26.5.7 released

DevFeed: [Keycloak 26.5.7 released](<https://devfeed.tech/articles/keycloak-26-5-7-released-31764.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/04/keycloak-2657-released>)

Author: Keycloak Team

Published: 2026-04-02T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Quarkus](<https://devfeed.tech/topics/quarkus.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [quarkus](<https://devfeed.tech/tags/quarkus.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.5.7 was released on April 2, 2026. The release includes multiple security fixes, including issues involving access control, information disclosure, denial of service, unauthorized permission grants, OIDC redirect URI validation, and authorization-code privilege escalation. It also upgrades to Quarkus 3.27.3 and resolves a Host-header error.

## Source excerpt

To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw Enhancements #46631 Upgrade to Quarkus 3.27.3 dist/quarkus Bugs #45204 Call without Host header throws uncaught error core