# Keycloak Blog Keycloak Blog This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague DevFeed: [KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague]() Original publisher: [Read original article]() Author: Alina Rudyk Published: 2026-08-23T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [identity and access management](), [openid](), [Security]() Tags: [iam](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [saml](), [security](), [sso](), [talk]() ### AI overview Keycloak has announced the speaker line-up and agenda for KEYCONF26, taking place in Prague on 8 October 2026. The programme covers Keycloak operations, extensions, identity standards, security, access tokens, and related use cases. ### Source excerpt The KEYCONF26 speaker line-up is taking shape, and this year's agenda is now live! 📍 KEYCONF26 is taking place in Prague on 8 October 2026. This October, the Keycloak community will come together once again for a full day of technical insights, real-world experiences and conversations around identity and access management. This year's programme brings together speakers from across the Keycloak ecosystem - from organisations running Keycloak in complex production environments to experts exploring new standards, architectures and use cases. Talk highlights The talks announced highlight the broad spectrum of the Keycloak ecosystem: how to run Keycloak securely and at scale, how to extend it, and how identity is evolving to support new technologies and use cases. Here are just a few highlights: What Role Can Keycloak Play for International Science? An Introduction to the OpenID Shared Signals Framework Keycloak becomes familiar with AI: the advancement of integrating Keycloak with AI Wicked Keycloak challenges and how to resolve them Token Hygiene - Why Your Keycloak Access Tokens Need a Diet And that is only a glimpse of what is waiting for you in Prague 👉 Explore the KEYCONF26 agenda announced: https://keyconf.dev/ A great place to network KeyConf is about more than the talks. It is also an opportunity to meet the people behind the technology, exchange experiences and connect with others working on similar identity challenges. Networking lunch Our extended lunch break gives you plenty of time to meet fellow attendees, swap ideas and continue conversations from the sessions in a relaxed setting. Meet the community KeyConf brings together Keycloak users, contributors, developers, architects, security specialists and IAM experts from different organisations and industries. Whether you want to discuss a challenge from your own Keycloak environment, exchange experiences or simply meet people from the community in person, there will be plenty of opportunities to connect thr ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak Client Libraries 26.0.12 released DevFeed: [Keycloak Client Libraries 26.0.12 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Caching](), [Security](), [client](), [test]() Tags: [cache](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [openid-connect](), [resolved](), [saml](), [security](), [sso](), [test]() ### AI overview Keycloak Client Libraries 26.0.12 was released with security fix #234, which normalizes URIs so mutated URIs share the cache key of their canonical form, and bug fix #231 related to changed authentication resource behavior causing test failures. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #234 Normalize URIs in PathConfigMatcher to ensure mutated URIs share the same cache key as their canonical form client Bugs #231 AuthenticationManagementResource changed behavior causes test failures client ## The future of the Keycloak Discourse forum DevFeed: [The future of the Keycloak Discourse forum]() Original publisher: [Read original article]() Author: GR Patil, Niko Köbler Published: 2026-07-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [ai-coding](), [dev-tools](), [maintenance](), [Security]() Tags: [ai](), [ai-coding](), [developer-tools](), [idm](), [kerberos](), [keycloak](), [ldap](), [maintenance](), [openid-connect](), [saml](), [security](), [sso]() ### AI overview The Keycloak project announces that it will wind down its Discourse forum. The article explains the forum's historical role, increased use of AI coding assistants and search-like developer tools, reduced forum activity, and the maintenance effort required to keep it open. ### Source excerpt The Keycloak project has always relied on open, searchable, community-owned discussion. Over the years, the Keycloak Discourse forum has been an important part of that: a place where users could ask configuration questions, share migration experiences, debug integrations, and find answers from people who had solved similar problems before. After a lot of consideration, we have decided to wind down the Keycloak Discourse forum. This is not a decision we are taking lightly. The forum contains many years of useful community knowledge, and we recognize the role it has played for Keycloak users. We also recognize that previous changes to the forum caused disruption. For that reason, we want to explain why we are making this change, how it will happen, when it will happen, and where the community should go next. Why we are making this change In June 2023, the Keycloak maintainers decided to sunset Discourse as one of the project's communication channels. That decision was met with strong feedback from the community. Many users explained that Discourse filled an important role that was not fully covered by mailing lists, GitHub Discussions, or chat. After listening to that feedback, we reactivated Discourse in October 2023. In the years since, the way developers seek help has changed. More and more Keycloak users now turn first to AI coding assistants and search-like developer tools when they need help configuring Keycloak, troubleshooting integrations, or understanding errors. Those tools have almost certainly learned from many of the public sources the community has created over the years, including the Discourse forum, GitHub Discussions, mailing lists, documentation, blog posts, and issue trackers. That shift has changed the role of a community forum. The old model depended on a steady flow of new questions, answers, corrections, and follow-up discussion. Without that activity, the forum risks becoming a stale support archive rather than a healthy community space. Keep ## Multi-Cluster v2 and Stateless Mode now in Preview DevFeed: [Multi-Cluster v2 and Stateless Mode now in Preview]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-07-17T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [Database](), [Availability](), [Replication](), [Kubernetes](), [Amazon Web Services]() Tags: [authentication](), [availability](), [clustering](), [database](), [distributed](), [failover](), [idm](), [kerberos](), [ldap](), [monitoring](), [openid-connect](), [preview](), [replication](), [saml](), [sso]() ### AI overview Keycloak 26.7 introduces Stateless Mode as a preview. It moves volatile data, including authentication sessions, action tokens, and brute-force counters, from Infinispan caches to the database, supporting multi-cluster deployments without an external Infinispan cluster. ### Source excerpt Starting with Keycloak 26.7, the stateless feature is available as a preview. It fundamentally simplifies how Keycloak handles volatile data -- authentication sessions, action tokens, and brute-force counters move from embedded or external Infinispan caches to the database. The result: Keycloak deployments that are easier to operate, more resilient, and ready for multi-cluster setups without an external Infinispan cluster. Read on to learn more, and ask questions in our upcoming live Q&A event on Jul 21! The problem with the current approach A multi-cluster setup becomes necessary when no transparent networking between two sites is available for Keycloak's embedded Infinispan to form a single cluster -- for example, when sites are in different availability zones or data centers without a shared network layer. Running Keycloak in such a multi-cluster setup today requires significant infrastructure beyond Keycloak itself. Without the stateless feature, the architecture depends on an external Infinispan cluster with cross-datacenter replication channels, dedicated monitoring to detect and handle Infinispan failover, and operational procedures for failback. It was tied to specific environments like Kubernetes and AWS, and using it in other environments would require significant work to adapt it. Even in single-cluster deployments, Infinispan clustering introduces operational overhead: rebalancing data in distributed caches when a node is lost or restarted, and transient failures in login flows if a node unexpectedly disappears. In large installations, the login failure cache can grow significantly, consuming substantial memory and causing long rebalancing times when nodes join or leave the cluster. While distributed caches replicate data across at least two nodes -- so individual node failures do not lose data -- a full cluster restart during minor upgrades resets volatile state such as in-progress authentication sessions and brute-force counters. What changes with stateles ## Keycloak Client Libraries 26.0.11 released DevFeed: [Keycloak Client Libraries 26.0.11 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-15T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [client](), [servers](), [ci](), [migration]() Tags: [2026](), [bugs](), [changes](), [ci](), [client](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [resolved](), [saml](), [sso]() ### AI overview Keycloak Client Libraries 26.0.11 was released on July 15, 2026. The release notes mention an enhancement to sync after the Keycloak server 26.7.0 release and a CI failure issue in keycloak-client. Users are directed to the migration guide before upgrading. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #226 Sync after Keycloak server 26.7.0 release client Bugs #222 keycloak-client CI is failing client ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## Experimental Shared Signals Framework support DevFeed: [Experimental Shared Signals Framework support]() Original publisher: [Read original article]() Author: Thomas Darimont Published: 2026-07-03T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [openid](), [Security](), [JSON Web Tokens](), [HTTP](), [Software as a service]() Tags: [experimental](), [http](), [idm](), [jwt](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [release](), [saas](), [saml](), [security](), [sso]() ### AI overview Keycloak announces experimental support for the OpenID Shared Signals Framework 1.0 in its nightly release. It can transmit signed Security Event Tokens about identity-related events to subscribed receivers over standardized HTTP push or poll channels, enabling faster propagation of changes such as session revocation, account disabling, credential rotation, and device non-compliance. ### Source excerpt We are excited to announce that Keycloak now provides experimental support for the OpenID Shared Signals Framework 1.0 specification, available from today in the nightly release. This allows Keycloak to act as a Shared Signals Transmitter, pushing signed Security Event Tokens (SETs) about identity-relevant events to any subscribed Receiver, using a standardised wire format defined by the OpenID Foundation. This closes a long-standing gap. When you revoke a user's session in Keycloak today, the SaaS app they're logged into usually doesn't sign them out until their next token refresh, which can be minutes, hours, or in some cases never. The same gap exists when an account is disabled, a credential is rotated, or a device is flagged as non-compliant. Keycloak knows; the relying parties don't, until they happen to ask again. With SSF, Keycloak can now push those signals to subscribed receivers in seconds -- no per-vendor webhooks, no bespoke polling endpoints, no Kafka topic per integration. Concretely, this also unlocks an integration the Keycloak ecosystem has been missing: Keycloak can now act as the federated IdP for Apple Business and Apple School Manager, signalling user-state changes back to Apple so enrolled devices can ask the user to reauthenticate. This post is the first in a small series. It introduces SSF, walks through what's actually shipped in the experimental release, and outlines where we'd like to take it next. Follow-up posts will cover how to define custom events, how to emit synthetic events, and an Apple Business and Apple School Manager integration end to end. A short tour of Shared Signals The OpenID Foundation's Shared Signals Framework 1.0 defines a standard way for one party (the Transmitter) to tell another party (the Receiver) about identity-relevant events as they happen. Each event is delivered as a signed JWT, a Security Event Token (RFC 8417) delivered over either an HTTP push channel (RFC 8935) or an HTTP poll channel (RFC 8936). Two pr ## Keycloak Client Libraries 26.0.10 released DevFeed: [Keycloak Client Libraries 26.0.10 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [client](), [Keycloak](), [Documentation]() Tags: [bugs](), [changes](), [client](), [docs](), [guide](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [openid-connect](), [resolved](), [saml](), [sso]() ### AI overview Keycloak Client Libraries 26.0.10 was released on June 30, 2026. The release includes resolved issues involving supported Keycloak server versions and downstream documentation builds. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #208 Clarification of supported keycloak server versions client #210 Latest changes break downstream docs build for 26.6 client ## Save the Date: Keycloak DevDay 2027 DevFeed: [Save the Date: Keycloak DevDay 2027]() Original publisher: [Read original article]() Author: Niko Köbler, Sebastian Rose Published: 2026-06-29T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Hackathon]() Tags: [2026](), [blog](), [community](), [conference](), [contributors](), [germany](), [hackathon](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [saml](), [sessions](), [sso](), [submission](), [talks]() ### AI overview Keycloak DevDay 2027 will take place in Darmstadt, Germany, on April 8-9, 2027. The event will include a conference day with community talks and deep dives, followed by a community day with a hackathon and OpenSpace sessions. Ticket sales have not started, and the call for papers is planned for around the end of August. ### Source excerpt ‼ Mark your calendars! Keycloak DevDay 2027 is coming back to Darmstadt, Germany, on April 8-9, 2027 ‼ Like the previous edition, DevDay 2027 will span two days with the same overall structure - though with a few notable changes participants will notice: 📅 Thursday, April 8, 2027 - Conference Day: talks and deep dives from the Keycloak community and contributors. 📅 Friday, April 9, 2027 - Community Day: a more informal, hands-on day featuring a Hackathon and an OpenSpace with multiple breakout sessions, where attendees shape the agenda together. Stay in the loop Ticket sales haven't started yet, and we don't want you to miss your chance to grab one of the strictly limited seats. If you haven't already, subscribe to the newsletter on keycloak-day.dev to be the first to know the moment tickets go live. Call for Papers We're planning to open the Call for Papers around the end of August. Keep an eye on the newsletter and this blog for the exact date and submission details. Something to watch in the meantime While you wait, why not revisit the talks from past years editions? The full playlists of Keycloak DevDay videos are available on YouTube: Keycloak DevDay 2026 video playlist Keycloak DevDay 2025 video playlist Keycloak DevDay 2024 video playlist We can't wait to see you in Darmstadt next April! Niko & Sebastian ## Keycloak 26.6.4 released DevFeed: [Keycloak 26.6.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens](), [upgrade](), [Quarkus]() Tags: [2026](), [authentication](), [authorization](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [quarkus](), [reference](), [release](), [saml](), [security](), [sso](), [upgrade](), [xss]() ### AI overview Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus ## Meet Keycloak at KubeCon Japan in July DevFeed: [Meet Keycloak at KubeCon Japan in July]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-06-20T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [MCP](), [Authorization](), [agentic workflows]() Tags: [authorization](), [conference](), [event](), [idm](), [japan](), [kerberos](), [keycloak](), [kubecon](), [ldap](), [mcp](), [openid-connect](), [saml](), [sso]() ### AI overview The Keycloak project announces its participation in KubeCon Japan Yokohama in July 2026, including KeycloakCon, a community kiosk, and technical talks. Sessions will cover Keycloak's authorization support for MCP and cloud-native identity and access management patterns. ### Source excerpt The Keycloak project is back at KubeCon Japan Yokohama with all highlights: Talks, our kiosk in the Project Table, and this time also with KeycloakCon, our very-own co-located event! If you are new to Keycloak, or already a user, join us for this exciting event to learn and connect. Half-day KeycloakCon packed with all-things-Keycloak KeycloakCon is a co-located event happening on Tuesday, July 28 from 09:00 to 12:30. It brings together the Keycloak community with case studies and talks featuring the latest features. Join this event for technical talks, professional growth, and networking opportunities. Book your ticket as an add-on to the KubeCon + CloudNativeCon pass. Use the discount code KCJP26STKEYCC and save 280 USD on the combined offer of KeycloakCon and KubeCon! & & & & '' ## Keycloak 26.6.3 released DevFeed: [Keycloak 26.6.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [LDAP](), [saml](), [WebAuthn](), [Netty]() Tags: [cors](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.6.3 is released with security fixes and other resolved weaknesses, including issues affecting OIDC, CORS, access control, LDAP federation, SAML, WebAuthn, and token handling. The article directs users to the Keycloak downloads and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations #49433 [CVE-2026-9803] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc Weaknesses #48978 UNSAFE_PATH ## Meet Keycloak at KubeCon India in June DevFeed: [Meet Keycloak at KubeCon India in June]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-05-26T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Extension]() Tags: [community](), [contributors](), [extensions](), [idm](), [india](), [kerberos](), [keycloak](), [kubecon](), [ldap](), [maintainers](), [openid-connect](), [saml](), [sso]() ### AI overview Keycloak will participate in KubeCon + CloudNativeCon India 2026 in Mumbai on June 18-19. Attendees can meet Keycloak maintainers, contributors, and the wider community at the project table in the Project Pavilion. ### Source excerpt This year's KubeCon India is coming to Mumbai, and Keycloak will be part of this year's edition on June 18-19! Register today to get tickets! A lot of people use Keycloak and develop extensions in for Keycloak in India, so we are thrilled to connect with the community. ' '' ## Keycloak experimental AuthZEN Support DevFeed: [Keycloak experimental AuthZEN Support]() Original publisher: [Read original article]() Author: Ryan Emerson Published: 2026-05-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [openid](), [API](), [REST API](), [interoperability](), [vendor lock-in]() Tags: [authentication](), [changes](), [idm](), [interoperability](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [release](), [resource](), [rest-api](), [saml](), [sdks](), [sso](), [vendor-lock-in](), [works]() ### AI overview Keycloak announces experimental support for the OpenID AuthZEN Authorization API 1.0 specification starting with version 26.7.0. The feature lets Keycloak act as a Policy Decision Point and expose existing authorization policies through a standardized API for Policy Enforcement Points. ### Source excerpt We are excited to announce that from 26.7.0, Keycloak will include experimental support for the OpenID AuthZEN Authorization API 1.0 specification. This allows Keycloak to act as a Policy Decision Point (PDP), exposing its authorization capabilities through a standardized API that any Policy Enforcement Point (PEP) can consume. You can try this now with the Keycloak nightly release. Why AuthZEN? Authorization has long been fragmented, with competing systems defining their own protocols for answering the same fundamental question: "Can this subject perform this action on this resource?". This means applications are tightly coupled to whichever authorization backend they choose, and swapping providers requires rewriting integration code. AuthZEN changes this by defining a single, vendor-neutral API between the component that asks (the PEP) and the component that decides (the PDP). It is, in many ways, what OpenID Connect did for authentication -- but for authorization. With AuthZEN: No more vendor lock-in -- your application speaks one API regardless of the PDP behind it. RBAC, ABAC, and ReBAC under one roof -- different policy models can answer the same request format, enabling true interoperability across authorization paradigms. Centralized, externalized authorization -- policy logic lives in the PDP, not scattered across application code, making it easier to audit and update. Simpler integration -- a clean REST API with a minimal request/response model replaces complex, implementation-specific SDKs. A growing ecosystem OpenID AuthZEN Interop demonstrates that over a dozen independently-developed PDPs can be used interchangeably by the same PEP without changing a single line of application code. By adding AuthZEN support, Keycloak joins this ecosystem and lets you leverage your existing Keycloak policies through the same standardized API used by every other AuthZEN-compatible PDP. How it works The interaction between your application and Keycloak follows the standard PE ## Keycloak 26.6.2 released DevFeed: [Keycloak 26.6.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-05-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Vulnerabilities](), [Security](), [Authentication](), [OpenID connect (OIDC)](), [WebAuthn](), [XSS]() Tags: [2](), [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [permission](), [pii](), [release](), [saml](), [security](), [sso](), [vulnerability](), [xss]() ### AI overview Keycloak 26.6.2 is a security-focused release that fixes multiple vulnerabilities, including denial-of-service issues, request smuggling, access-control flaws, stored XSS, WebAuthn policy bypass, token disclosure, account takeover, and PII enumeration. It also includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn #48570 [CVE-2026-0636, CVE-2026-3505, CVE-2026-5598] Multiple bouncycastle CVEs core #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration Enhancements #47728 Monitor backups for CNPG - ## New Keycloak Maintainer: Ricardo Martin DevFeed: [New Keycloak Maintainer: Ricardo Martin]() Original publisher: [Read original article]() Author: Stian Thorgersen Published: 2026-05-07T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Passkeys](), [saml]() Tags: [authentication](), [bugs](), [community](), [contributors](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [protocols](), [pull-requests](), [saml](), [security](), [sso]() ### AI overview Keycloak announces Ricardo Martin as an official maintainer. The article highlights his contributions to core Keycloak areas, authentication protocols, community support, bug fixes, pull-request reviews, and security issue resolution. ### Source excerpt Ricardo joined the Keycloak IBM team at the beginning of 2023 and became one of the top Keycloak contributors since then. Ricardo has very deep knowledge in many core Keycloak areas. He is the most knowledgeable person from the whole team in areas like for example SAML, Passkeys or FIPS. His expertise is not limited to just those areas, but rather he has deep knowledge around pretty much every aspect of protocols and authentication in Keycloak. Additionally, Ricardo is very active in helping the community, joining discussions, fixing bugs, reviewing pull requests, as well as an active participant in triaging and resolving security issues. Congratulations to Ricardo becoming an official Keycloak Maintainer. ## Fine-Grained Admin Permissions for Organizations DevFeed: [Fine-Grained Admin Permissions for Organizations]() Original publisher: [Read original article]() Author: Vlasta Ramik Published: 2026-05-07T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [Security]() Tags: [idm](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [permissions](), [policies](), [rest-api](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.0 adds Fine-Grained Admin Permissions support for Organizations, allowing administrators to assign organization-level manage or view access instead of requiring realm-wide administrative control. ### Source excerpt In Keycloak 26.7.0, Fine-Grained Admin Permissions (FGAP) will support Organizations as a resource type. This means you can grant an administrator permission to manage Org A while only allowing them to view Org B -- or restrict their access to a single organization entirely. No more realm-wide all-or-nothing admin access for organizations. The Problem Before this release, administering organizations required the manage-realm role, which grants far broader access than just organizations -- it covers realm settings, authentication flows, and much more. There was no way to grant someone access to manage organizations without also giving them control over the entire realm. In multi-tenant deployments where different teams or partners own different organizations, this was a significant security and operational concern. What's New Two changes in Keycloak 26.7.0 work together to solve this: Organization-Specific Admin Roles Organizations will support scoped admin roles that let you delegate day-to-day management tasks without granting realm-wide access. An organization administrator can: Create, update, and delete organizations Invite new members and revoke membership Link and unlink identity providers Manage organization groups These roles grant access to all organizations in the realm and can only be assigned by realm administrators, ensuring that privilege escalation stays under control. Organizations as a FGAP Resource Type Organizations will be a first-class resource type in the Fine-Grained Admin Permissions system, alongside Users, Groups, or Clients. This brings two permission scopes for organizations: manage -- full administrative control over the organization view -- read-only access to the organization and its configuration When FGAP is enabled, permissions can be set per organization. An administrator who is granted manage and view on Org A and view on Org B will see both organizations, but would be able to update (or make other managerial tasks) just Org A in the ## Announcing Keycloak's Identity Summit: KEYCONF26 DevFeed: [Announcing Keycloak's Identity Summit: KEYCONF26]() Original publisher: [Read original article]() Author: Nathalia Pinesi, Alexander Schwartz Published: 2026-05-02T00:00:00Z Content type: article Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [IAM](), [identity and access management](), [OAuth 2.0](), [OpenID connect (OIDC)](), [Single sign-on (SSO)](), [Kubernetes](), [Security]() Tags: [2026](), [conference](), [identity](), [identity-and-access-management](), [idm](), [implementation](), [kerberos](), [keycloak](), [kubernetes](), [ldap](), [oauth2](), [oidc](), [openid-connect](), [saml](), [security](), [sso](), [summit]() ### AI overview Keycloak announces KEYCONF26, its annual Identity Summit for the Keycloak user community, taking place in Prague on October 8, 2026. The event will feature interactive sessions, practical discussions, networking, and a call for speakers and sponsors. ### Source excerpt Our annual conference dedicated to the Keycloak user community returns, with even more content and networking opportunities than last year. It's the perfect place to interact, learn, share, and exchange insights and real-world use cases, network with fellow experts, users, and contributors. 📍 Introducing KEYCONF26 - taking place in Prague on October 8th, 2026! This year's edition of the Keycloak Identity Summit features interactive sessions, and even more opportunities to engage with the people shaping the future of identity and access management. Call for sessions The call for sessions is open until May 24th, 2026 -- we'd love to hear from you! We're looking for sessions on topics such as: Keycloak deployment and operations at scale Human and non-human identities in the world of AI OAuth2, OIDC, and evolving identity standards Security best practices and hardening EU Digital Identity Wallets and eIDAS Migration stories and real-world use cases Extending and customizing Keycloak Submit your proposal now! What to expect at KEYCONF26 Inspiring Keynote Speaker Hear from Hannah Short, Team Lead for Identity and Access Management at CERN, how they are using Keycloak as a highly performant and reliable SSO running on Kubernetes. Connect with like-minded professionals From long-time contributors to those just starting their IAM journey, KEYCONF26 is the perfect place to meet others working with identity, OAuth2, OIDC, and more. Networking lunch Our extended lunch break is designed to help you meet fellow attendees, swap ideas, and build meaningful professional connections in a relaxed setting. Business drinks Stick around after the last session for informal networking over drinks. Want to sponsor this year's Business Drink? Get in touch with us--we'd love to partner with you! Expert sessions and real-world use cases Gain practical insights into Keycloak implementation, security improvements, OAuth2 best practices, and evolving identity standards. Learn how to use EU Digital ## Organization Groups: Structure Your Organizations with Hierarchical Group Management DevFeed: [Organization Groups: Structure Your Organizations with Hierarchical Group Management]() Original publisher: [Read original article]() Author: Vlasta Ramik Published: 2026-04-29T00:00:00Z Content type: tutorial Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [structure](), [Authentication](), [OpenID connect (OIDC)](), [saml]() Tags: [authentication](), [b2b](), [idm](), [kerberos](), [keycloak](), [ldap](), [oidc](), [openid-connect](), [saml](), [sso](), [structure]() ### AI overview Keycloak 26.6.0 introduces Organization Groups, enabling isolated hierarchical groups within each organization. The article explains how to create and reorganize group hierarchies, assign users through identity-provider mappers, and include organization group memberships in OIDC tokens and SAML assertions. ### Source excerpt Introduced in Keycloak 26.6.0, Organization Groups bring hierarchical group management to the Organizations feature. While Organizations already let you model Business-to-Business (B2B) relationships where external companies, partners, or departments each manage their own users, Organization Groups take this further by letting you organize members within each organization into logical teams, departments, or any structure that fits your needs. Why Organization Groups? Before Organization Groups, structuring members within an organization required workarounds using realm-level groups, which are shared across the entire realm. This creates problems in multi-tenant scenarios: if Organization A and Organization B both need an "Engineering" group, they'd collide at the realm level. Organization Groups solve this by giving each organization its own isolated group hierarchy. Organization A's /Engineering/Backend and Organization B's /Engineering/Backend are completely separate groups with their own members, attributes, and identifiers. No naming conflicts, no cross-organization leakage. Creating a Group Hierarchy Groups can be nested to mirror real-world organizational structures: /Engineering /Engineering/Backend /Engineering/Frontend /Sales /Sales/APAC /Sales/EMEA /Sales/LATAM /Sales/NA Creating groups is straightforward: navigate to your organization, click the Groups tab, and click Create group. To build hierarchies, select a parent group before creating a child group, or use Move to to reorganize existing groups. Automatic Group Assignment via Identity Providers One of the most powerful capabilities is automatic group assignment during federated authentication. When an identity provider is linked to an organization, two mapper types are available: Hardcoded Group assigns every user authenticating through the IdP to a specific organization group. Useful for scenarios like "everyone from this corporate IdP goes into the Engineering team." Advanced Claim to Group maps use ## Keycloak JS 26.2.4 released DevFeed: [Keycloak JS 26.2.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-22T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Cordova](), [Authentication](), [browser](), [version]() Tags: [authentication](), [browser](), [bug-fixes](), [changes](), [cordova](), [idm](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [openid-connect](), [saml](), [sso](), [version]() ### AI overview Keycloak JS 26.2.4 fixes two Cordova adapter regressions introduced in version 26.2.1. It prevents duplicate authentication requests during token exchange and closes the in-app browser before the exchange begins, avoiding a brief Android error. ### Source excerpt Highlights This release of Keycloak JS addresses two regressions in the Cordova adapter that were introduced in version 26.2.1. Bug Fixes Cordova adapter no longer triggers duplicate authentication requests A regression introduced in version 26.2.1 caused the Cordova in-app browser to fire multiple loadstart events before the token exchange completed, resulting in concurrent authentication requests that could fail the login flow. The completed flag is now set before awaiting the token exchange, preventing duplicate processing of the redirect URI. keycloak/keycloak-js#208 Cordova in-app browser now closes before awaiting token exchange A regression introduced in version 26.2.1 caused the Cordova in-app browser to remain open during the asynchronous token exchange, resulting in a brief "Web page not available" error flashing on Android before the browser eventually closed. The browser is now closed immediately after the redirect URI is captured, before the token exchange begins. keycloak/keycloak-js#209 Upgrading Before upgrading refer to the migration guide for a complete list of changes. [Next page]()