# Keycloak 26.6.4 released

DevFeed: [Keycloak 26.6.4 released](<https://devfeed.tech/articles/keycloak-26-6-4-released-31778.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/06/keycloak-2664-released>)

Author: Keycloak Team

Published: 2026-06-26T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>), [Quarkus](<https://devfeed.tech/topics/quarkus.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [quarkus](<https://devfeed.tech/tags/quarkus.md>), [reference](<https://devfeed.tech/tags/reference.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [xss](<https://devfeed.tech/tags/xss.md>)

## AI overview

Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1.

## Source excerpt

To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus