# Keycloak JS Release Published articles for Keycloak JS Release. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak JS 26.2.4 released DevFeed: [Keycloak JS 26.2.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-22T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Cordova](), [Authentication](), [browser](), [version]() Tags: [authentication](), [browser](), [bug-fixes](), [changes](), [cordova](), [idm](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [openid-connect](), [saml](), [sso](), [version]() ### AI overview Keycloak JS 26.2.4 fixes two Cordova adapter regressions introduced in version 26.2.1. It prevents duplicate authentication requests during token exchange and closes the in-app browser before the exchange begins, avoiding a brief Android error. ### Source excerpt Highlights This release of Keycloak JS addresses two regressions in the Cordova adapter that were introduced in version 26.2.1. Bug Fixes Cordova adapter no longer triggers duplicate authentication requests A regression introduced in version 26.2.1 caused the Cordova in-app browser to fire multiple loadstart events before the token exchange completed, resulting in concurrent authentication requests that could fail the login flow. The completed flag is now set before awaiting the token exchange, preventing duplicate processing of the redirect URI. keycloak/keycloak-js#208 Cordova in-app browser now closes before awaiting token exchange A regression introduced in version 26.2.1 caused the Cordova in-app browser to remain open during the asynchronous token exchange, resulting in a brief "Web page not available" error flashing on Android before the browser eventually closed. The browser is now closed immediately after the redirect URI is captured, before the token exchange begins. keycloak/keycloak-js#209 Upgrading Before upgrading refer to the migration guide for a complete list of changes. ## Keycloak JS 26.2.3 released DevFeed: [Keycloak JS 26.2.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [bug](), [OAuth](), [Routing (disambiguation)](), [version](), [Angular](), [React]() Tags: [angular](), [bug](), [idm](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [oauth](), [openid-connect](), [react](), [regression](), [release](), [routing](), [saml](), [sso](), [version]() ### AI overview Keycloak JS 26.2.3 fixes a regression introduced in version 26.2.2 that URL-encoded path-style URL fragments after the OAuth callback when using fragment response mode, breaking hash-based routing. The issue affected Angular, React, and other client-side applications. ### Source excerpt Highlights This release of Keycloak JS addresses a regression that was introduced in version 26.2.2 affecting applications that use hash-based routing in combination with the fragment response mode. Bug Fixes URL hash fragments are now preserved correctly with 'fragment' response mode A regression was introduced in version 26.2.2 that caused URL fragments with path-style routing (e.g., #/admin/maintenance/scripts) to be URL-encoded after the OAuth callback, breaking applications that use hash-based routing. This issue affected Angular, React, and other applications that rely on the hash portion of the URL for client-side routing. keycloak/keycloak-js#241 Upgrading Before upgrading refer to the migration guide for a complete list of changes. ## Keycloak JS 26.2.2 released DevFeed: [Keycloak JS 26.2.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-12-11T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [OpenID connect (OIDC)](), [Routing (disambiguation)](), [Security]() Tags: [authentication](), [bug-fixes](), [idm](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [oidc](), [openid-connect](), [release](), [routing](), [saml](), [security](), [sso]() ### AI overview Keycloak JS 26.2.2 fixes regressions affecting public method destructuring, hash fragments and trailing slashes in redirect URIs, and redirects from different domains. The release also notes a planned future restriction on redirect URLs to help prevent open redirects. ### Source excerpt Highlights This release of Keycloak JS focuses on addressing several regressions that were introduced by accident. We apologize for any inconvenience these issues may have caused and thank our community for reporting them quickly and helping to verify the fixes. Bug Fixes Destructuring public methods now works correctly A regression was introduced that caused an error when destructuring public methods from a Keycloak instance. This pattern is commonly used in applications: const { login, logout } = keycloak; login(); // Previously failed with "Cannot read properties of undefined" This issue has been resolved by binding all public methods to the class instance using arrow functions, ensuring that this is always correctly scoped regardless of how the method is called. keycloak/keycloak-js#202 Hash fragments are now preserved in redirect URIs A regression caused hash fragments in URLs to be stripped from redirect URIs, which broke navigation in applications that rely on fragment-based routing. For example, when logging in to the Keycloak Admin Console with a URL like http://localhost:8080/admin/master/console/#/demo/users/add-user, the user would be redirected to the default page instead of the intended fragment after authentication. This also caused issues where redirect URIs would have a trailing slash added unexpectedly, breaking login flows for OIDC servers that perform strict URI matching. The next major of Keycloak JS will start re-enforcing this constraint, as it is not allowed to pass fragments according to the specification. keycloak/keycloak-js#151, keycloak/keycloak-js#205 Redirect URLs on different domains now work correctly A regression prevented redirect URLs from being on a different domain than the application origin the navigation to fail with a security error. This affected users who use redirect services that forward authentication requests from an intermediate domain back to the application. This behavior is likely to be changed in the future to onl ## Keycloak JS 26.2.1 released DevFeed: [Keycloak JS 26.2.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-10-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [JavaScript](), [test-coverage](), [migration]() Tags: [bugfixes](), [idm](), [javascript](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [saml](), [sso](), [test-coverage]() ### AI overview Keycloak JS 26.2.1 is a patch release following its separation from the main project release cycle. It includes an internal refactor, modern JavaScript language features, a new test suite with more comprehensive test coverage, bug fixes, and small enhancements, with no expected breaking changes for users. ### Source excerpt Highlights This release of Keycloak JS is the first release after our initial announcement to split if off from the main project release cycle. This release is the result of a large internal refactor to make the code more maintainable and make use of modern JavaScript language features, as well as to introduce a new test suite with more comprehensive test coverage. Even though much has changed under the hood, this is a patch releases, and there should be no breaking changes for users, only bugfixes and small enhancements. Upgrading Before upgrading refer to the migration guide for a complete list of changes. ## Keycloak JS 26.2.0 released DevFeed: [Keycloak JS 26.2.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-02-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JavaScript](), [releases](), [version](), [Maintainability](), [npm]() Tags: [idm](), [javascript](), [kerberos](), [keycloak](), [keycloak-js-release](), [ldap](), [maintainability](), [npm](), [openid-connect](), [release](), [releases](), [saml](), [sso](), [version]() ### AI overview Keycloak JS 26.2.0 was released with no functional adapter changes. The JavaScript adapter now follows an independent release cycle, remains backward compatible with actively supported Keycloak server releases, and has moved to a dedicated repository to improve maintainability and community contribution workflows. ### Source excerpt Highlights Today marks a significant milestone in the evolution of Keycloak JS with the release of version 26.2.0. This new version represents a shift in how the JavaScript adapter develops and evolves alongside the Keycloak ecosystem. Although this new version introduces no functional changes to the adapter, it does include several organizational changes. The most notable change is that Keycloak JS now breaks free from the main Keycloak project's release cycle. As announced earlier this year, the JavaScript adapter will follow its own independent development path. The separation from the main project allows for more frequent releases of features, bug fixes, and improved responsiveness to community feedback. The JavaScript adapter will continue to be backwards compatible with all actively supported releases of the Keycloak server, and deviation from this will be considered a breaking change. The choice to use a higher version than the main project itself was made intentionally in order to signal to users the departure from Keycloak's release cycle. We will however continue to commit to using Semantic Versioning, only bumping major versions if backwards incompatible changes are made, as is customary in the NPM ecosystem. Maintenance updates will continue to land in the 26.1.x series, as it is tied to the current stable release of the Keycloak server, but we encourage users to upgrade to new versions as needed. Another significant change is the relocation of the codebase to its own dedicated repository. This structural adjustment is not just administrative--it represents a strategic move toward better maintainability. By separating the JavaScript adapter from the main Keycloak repository, the development team gains greater flexibility in managing the codebase and processing community contributions. If you are looking to provide contributions, or are reporting issues, please redirect your efforts here. Looking ahead, we will be focussing on what is next for Keycloak JS.