# Keycloak Release Published articles for Keycloak Release. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## Keycloak 26.6.4 released DevFeed: [Keycloak 26.6.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens](), [upgrade](), [Quarkus]() Tags: [2026](), [authentication](), [authorization](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [quarkus](), [reference](), [release](), [saml](), [security](), [sso](), [upgrade](), [xss]() ### AI overview Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus ## Keycloak 26.6.3 released DevFeed: [Keycloak 26.6.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [LDAP](), [saml](), [WebAuthn](), [Netty]() Tags: [cors](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.6.3 is released with security fixes and other resolved weaknesses, including issues affecting OIDC, CORS, access control, LDAP federation, SAML, WebAuthn, and token handling. The article directs users to the Keycloak downloads and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations #49433 [CVE-2026-9803] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc Weaknesses #48978 UNSAFE_PATH ## Keycloak 26.6.2 released DevFeed: [Keycloak 26.6.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-05-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Vulnerabilities](), [Security](), [Authentication](), [OpenID connect (OIDC)](), [WebAuthn](), [XSS]() Tags: [2](), [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [permission](), [pii](), [release](), [saml](), [security](), [sso](), [vulnerability](), [xss]() ### AI overview Keycloak 26.6.2 is a security-focused release that fixes multiple vulnerabilities, including denial-of-service issues, request smuggling, access-control flaws, stored XSS, WebAuthn policy bypass, token disclosure, account takeover, and PII enumeration. It also includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn #48570 [CVE-2026-0636, CVE-2026-3505, CVE-2026-5598] Multiple bouncycastle CVEs core #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration Enhancements #47728 Monitor backups for CNPG - ## Keycloak 26.6.1 released DevFeed: [Keycloak 26.6.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-15T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [CloudNativePG](), [Database](), [OpenID connect (OIDC)]() Tags: [2026](), [authentication](), [cloudnativepg](), [cve](), [database](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso](), [version]() ### AI overview Keycloak 26.6.1 is a release that includes security fixes for blind server-side request forgery and user enumeration, updates CloudNativePG to 1.29, adds database data-at-rest encryption, and resolves various bugs and documentation issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling core #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login core Enhancements #47839 Update CloudNativePG to 1.29 #47909 Database data at rest encryption Bugs #47435 AuroraDB IT CI workflow not cleaning up databases testsuite #47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail testsuite #47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope oidc #47827 az vm create fails with JSON parsing error ci #47872 v26.6.0 Operator flood logs with warnings operator #47889 Not possible to sync latest keycloak-admin-client to keycloak-client admin/client-java #47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0 admin/client-js #47905 invalid package reference in keycloak-admin-ui admin/ui #47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication organizations #47929 User profile multiselect options not highlighted as selected in dropdown admin/ui #47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint identity-brokering #48015 Missing explicit docs anchor for organizations docs #48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap dist/quarkus ## Keycloak 26.6.0 released DevFeed: [Keycloak 26.6.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [JSON Web Tokens](), [Authentication](), [Authorization](), [OAuth 2.0](), [Security](), [openid](), [Kubernetes](), [SPIFFE]() Tags: [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [release](), [releases](), [saml](), [security](), [sso](), [test]() ### AI overview Keycloak 26.6.0 introduces JWT Authorization Grant, federated client authentication, workflows for realm administration, zero-downtime patch releases, and a new test framework. The release also includes a preview of Identity Brokering APIs V2 and a guide to OAuth 2.0 DPoP. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: JWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions. Federated client authentication, eliminating the need to manage individual client secrets in Keycloak. Workflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management. Zero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime. The Keycloak Test Framework, replacing the previous Arquillian-based solution. All of these features are now fully supported and no longer in preview. Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (supported) JWT Authorization Grant (RFC 7523) is designed to implement external-to-internal token exchange use cases. This grant allows using externally signed JWT assertions to request OAuth 2.0 access tokens. In this release, JWT Authorization Grant is promoted from preview to supported. See the JWT Authorization Grant guide for additional details. Federated client authentication (supported) Federated client authentication allows clients to leverage existing credentials once a trust relationship with another issuer exists. It eliminates the need to assign and manage individual secrets for each client in Keycloak. Federated client authentication is now promoted to supported, including support for client assertions issued by external OpenID Connect identity providers and Kubernetes Service Accounts. Since the OAuth SPIFFE Client Authentication specification is still in draft status, this feature remains a preview feature in Keycloak. New guide about Demonstrating Proof-of-Possession (DPoP) A new guide for OAuth 2.0 D ## Keycloak 26.5.7 released DevFeed: [Keycloak 26.5.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-04-02T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [Quarkus]() Tags: [access-control](), [authorization](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.5.7 was released on April 2, 2026. The release includes multiple security fixes, including issues involving access control, information disclosure, denial of service, unauthorized permission grants, OIDC redirect URI validation, and authorization-code privilege escalation. It also upgrades to Quarkus 3.27.3 and resolves a Host-header error. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45493 CVE-2025-14083 keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure admin/api #45569 CVE-2026-1002 - io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files #47069 CVE-2026-3429 Improper Access Control for LoA During Credential Deletion account/api #47716 CVE-2026-4634 Keycloak Application-Level DoS via Scope Processing #47717 CVE-2026-4636 UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants #47718 CVE-2026-3872 Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint #47719 CVE-2026-4282 Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw Enhancements #46631 Upgrade to Quarkus 3.27.3 dist/quarkus Bugs #45204 Call without Host header throws uncaught error core ## Keycloak 26.5.6 released DevFeed: [Keycloak 26.5.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-03-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [Authentication]() Tags: [2026](), [access-control](), [authentication](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [race-condition](), [release](), [saml](), [security](), [spiffe](), [sso]() ### AI overview Keycloak 26.5.6 was released on March 19, 2026. The release includes security fixes for issues including SSRF, refresh-token reuse bypass, improper access control, privilege escalation, authorization bypass, and information disclosure, along with other bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45645 CVE-2026-1180 - Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri oidc #45647 CVE-2026-1035 - Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition oidc #45650 CVE-2025-14777 - Keycloak IDOR in realm client creating/deleting #45653 CVE-2025-14082 keycloak-server: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure #46719 CVE-2026-3121 - Keycloak: Privilege escalation via manage-clients permission #46723 CVE-2026-3190 - Information Disclosure via improper role enforcement in UMA 2.0 Protection API core #46922 CVE-2026-3911 Keycloak: Information disclosure of disabled user attributes via administrative endpoint user-profile #47062 CVE-2026-2366 Authorization Bypass: Unprivileged tokens can enumerate user organization memberships organizations Bugs #45889 Federated user disabled when external DB unavailable, never re-enabled storage #46239 AUTH_SESSION_ID cookie reuse causes cross-user session contamination on re-authentication authentication #46296 UsersResource.search briefRepresentation started to return user attributes admin/api #46379 Unexpected error when logging out with offline session and external IDP oidc #46459 Operator-built DB config: targetServerType=primary not applied / connection validation not working after master-replica failover (26.5.0) operator #46588 Partial LDAP sync duration does not follow the defined value in user federation ldap #46605 26.5.4 startup regression with many realms: RealmCacheSession.prepareCachedRealm() scans master admin role composites per realm (O(N²)) core #46656 Em-Hyphens in SPI options on cache configuration page docs #46663 JGroups bind port configuration ignored when --cache-embedded-network-bind-port set infinispan #46669 SPIFFE Clie ## Keycloak 26.5.5 released DevFeed: [Keycloak 26.5.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-03-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [saml](), [Security](), [Authentication]() Tags: [2026](), [authentication](), [broker](), [cve](), [download](), [idm](), [idp](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [login](), [migration-guide](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.5.5 was released on March 5, 2026. The release includes security fixes for SAML broker authentication bypass, disabled identity provider enforcement, disabled SAML identity provider login, and encrypted assertion injection. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46909 CVE-2026-3047 SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login #46910 CVE-2026-3009 Improper Enforcement of Disabled Identity Provider in IdentityBrokerService #46911 CVE-2026-2603 Disabled SAML IdP still allows IdP-initiated broker login #46912 CVE-2026-2092 saml broker encrypted assertion injection ## Keycloak 26.5.4 released DevFeed: [Keycloak 26.5.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [saml](), [OpenID connect (OIDC)](), [upgrade]() Tags: [2026](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso](), [upgrade]() ### AI overview Keycloak 26.5.4 is released with security fixes, protocol enhancements, and bug fixes. The release includes fixes for SAML, OIDC, authorization, Docker Registry Protocol, organizations, clustering, caching, and related components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #45646 CVE-2026-1190 - Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData saml #45649 CVE-2026-0707: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass #45776 CVE-2025-5416 keycloak-core: Keycloak Environment Information #46372 CVE-2026-2575 - Denial of Service due to excessive SAMLRequest decompression saml #46462 CVE-2026-2733 Missing Check on Disabled Client for Docker Registry Protocol Enhancements #46090 New key affinity for session ids Bugs #44488 "Update email" AIA: "Back to Application" URL invokes OIDC callback with missing parameters oidc #45065 Client deletion timeout due to large number of client roles storage #45680 auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) saml #45728 Information Disclosure of Client Secret on Unauthenticated Config Endpoint oidc #45874 Disabled organizations still resolve in organization-aware login flows organizations #45966 KeycloakRealmImport: Realm created in DB but not visible in Admin Console until restart operator #45980 Keycloak cluster with 3 nodes and jdbc-ping stack fails to rejoin after temporary network partition infinispan #46100 Makes Database Query on Every Login Page Load Instead of Using Cache infinispan #46150 Move upgrading note for SAML to 26.5.4 docs #46178 Regression: cannot authenticate in keycloak-admin-client adapter/javascript #46290 Incorrect code used error, leading to "400 / Code already used" during Infinispan state transfers infinispan #46303 JWT Authorization Grant: Always getting "Token was issued too far in the past to be used now" for EntraID issued tokens oidc #46312 io.fabric8:docker-maven-plugin:0.40.3:start failed: Cannot invoke "com.google.gson.JsonElement.isJsonNull()" because the return value of "com.google.gso ## Keycloak 26.5.3 released DevFeed: [Keycloak 26.5.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-02-10T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JSON Web Tokens](), [Security](), [Authentication](), [upgrade](), [migration](), [Kubernetes](), [Mocha](), [Quarkus](), [ci](), [Hibernate](), [YAML]() Tags: [2025](), [authentication](), [authorization](), [ci](), [hibernate](), [idm](), [jwt](), [k8s](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration](), [node-js](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso](), [upgrade](), [yaml]() ### AI overview Keycloak 26.5.3 is a February 10, 2026 release that includes security fixes for JWT authorization grants, invitation JWTs, identity-provider ownership checks, and other resolved issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/ Enhancements #45892 Upgrade minikube for CI tests operator Bugs #44379 Node.js admin client does not refresh tokens admin/client-js #45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus #45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus #45677 Hibernate Validator is enabled by default when not used dist/quarkus #45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite #45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci #45755 Broken YAML indentation in operator rolling updates doc docs #45780 Remove fatal log messages from `ConsistentHash` ## Keycloak 26.5.2 released DevFeed: [Keycloak 26.5.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-01-23T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [MariaDB](), [MySQL]() Tags: [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso](), [vulnerability]() ### AI overview Keycloak 26.5.2 is a release containing security fixes, enhancements, and bug fixes. The resolved issues include vulnerabilities, SSO login problems, deadlocks, OIDC and admin API issues, database migration and collation problems, and other configuration and documentation corrections. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies Enhancements #43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging #45498 Ignore OpenAPI artifacts when disabled dist/quarkus Bugs #44785 Can not get through SSO login if using a custom attribute with default value user-profile #45015 Deadlock in Infinispan virtual threads infinispan #45250 IDToken contains duplicate address claims oidc #45333 User admin events don't show role, group mapping, reset password like events admin/ui #45396 Database Migration fails when updating to 26.5.0 on MS SQL core #45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan #45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile #45474 Admin REST API document is not up to date docs #45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations #45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus #45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability #45584 Keycloak supported specs should list DPoP as supported oidc #45590 OIDCIdentityProviderConfig issuer configuration token-exchange #45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations #45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users ## Keycloak 26.5.1 released DevFeed: [Keycloak 26.5.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-01-14T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [saml](), [WebAuthn](), [Java]() Tags: [authentication](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [render](), [saml](), [security](), [sso](), [ui](), [upgrade]() ### AI overview Keycloak 26.5.1 is a maintenance release containing enhancements and fixes for static-resource and REST response headers, database index performance, realm management, administration UI behavior, authentication, upgrades, SAML responses, organizations, and WebAuthn passkey lists. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #44863 x-robots HTTP header missing for static Keycloak resources, and REST endpoint responses #45009 Performance improvement: Missing indexes on BROKER_LINK table columns #45182 Allow full managing of realms from master realm without global admin role Bugs #43975 Test Framework -> Embedded server -> Maven execution failure: Failed to read script file from: scripts/default-policy.js test-framework #44371 403 Forbidden when assigning realm-management client roles despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions #44417 Security issue with Organization feature exposes and fills the account name automatically in user/password form organizations #44783 Create Realm button is missing when user has create-realm role admin/ui #44860 Admin UI: slow response time listing second user page admin/ui #45003 Bug in JWTClientAuthenticator and JWTClientSecretAuthenticator causes NPE authentication #45093 Enable visibility of Role Mapping tab for users with view-users role admin/ui #45107 Failed upgrade to 26.4.7 - sql generated for manual database upgrade contains invalid statements storage #45116 Realm-level admininistrators can no longer use Admin Console since 26.3.0 (UI fails to render) admin/ui #45185 ExternalLinkTest fails due to missing _adding_context_for_log_messages anchor docs #45226 Failure when decrypting SAML Response since 26.5.0 saml #45239 Upgrade to 26.5.0 failing due to FK_ORG_INVITATION_ORG constraint organizations #45257 Creating IdentityProvider with latest java admin-client may fail against Keycloak server 26.4 or older admin/client-java #45307 UI Bug: WebAuthn passkey list is broken in keycloak v2 theme login/ui ## Keycloak 26.5.0 released DevFeed: [Keycloak 26.5.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-01-06T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [JSON Web Tokens](), [Model Context Protocol](), [OpenTelemetry](), [Kubernetes](), [Cross-origin resource sharing (CORS)]() Tags: [authorization](), [cors](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [kubernetes](), [ldap](), [model-context-protocol](), [oauth](), [oauth-2-0](), [openid-connect](), [opentelemetry](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.5.0 introduces workflows for realm administration, JWT Authorization Grants in preview, additional documentation for using Keycloak as an authorization server for MCP servers, Kubernetes service-account-token authentication, and OpenTelemetry support for metrics and logging. It also includes CORS enhancements and other identity-management changes. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Workflows to automate administrative tasks and process within a realm. JWT Authorization Grants, our recommended alternative to external to internal token exchange. Guide for using Keycloak as an authorization server for Model Context Protocol (MCP) servers. Authenticating clients with Kubernetes service account tokens to avoid static client secrets. OpenTelemetry support for metrics and logging, combining all observability information in this popular standard. Read on to learn more about each new feature. If you are upgrading from a previous release, review also the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (preview) Keycloak 26.5 introduces a new feature called JWT Authorization Grant, which adds support for RFC 7523 to use external signed JWT assertions to request OAuth 2.0 access tokens. To accept signed JWT assertions, a trust relationship must be established between the external provider and Keycloak. This trust relationship can be configured through an identity provider in a dedicated section of the OpenID Connect v1.0 identity provider, or through the new JWT Authorization Grant identity provider. JWT Authorization Grant is recommended as an alternative to External to internal token exchange V1. This feature is in preview, and additional details are available in the dedicated documentation. Using Keycloak as an authorization server for Model Context Protocol (MCP) servers Using Keycloak as an authorization server for Model Context Protocol (MCP) servers is becoming popular, so this release ships additional documentation on how to do this. See Integrating with Model Context Protocol (MCP) for the new guide. Many thanks to Takashi Norimatsu for the contribution. CORS enhancements CORS (Cross Origin Resource Sharing) is a browser security feat ## Keycloak 26.4.7 released DevFeed: [Keycloak 26.4.7 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-12-01T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Quarkus](), [saml](), [Authorization]() Tags: [bugs](), [headers](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [permissions](), [quarkus](), [release](), [resolved](), [saml](), [sso](), [upgrade]() ### AI overview Keycloak 26.4.7 is released with documentation and Quarkus 3.27.1 upgrades, plus fixes for SAML initialization errors and persistent group permissions during concurrent membership changes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #43156 [Docs] Warn users about printing headers in HTTP access logs docs #43643 Upgrade to Quarkus 3.27.1 dist/quarkus Bugs #44438 Intermittent ConcurrentModificationException during SAML initialization causing status code 400 for clients saml #44480 Wrong persistent group permissions when multiple group membership changes happen in the same request core ## Keycloak 26.4.6 released DevFeed: [Keycloak 26.4.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-25T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [Security](), [upgrade](), [version]() Tags: [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [release](), [saml](), [security](), [sso](), [upgrade](), [version]() ### AI overview Keycloak 26.4.6 adds default filtering of LDAP referrals, improving security and aligning with LDAP configuration best practices. The release also includes a security fix for deserialization of untrusted data in LDAP user federation and other resolved issues. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release adds filtering of LDAP referrals by default. This change enhances security and aligns with best practices for LDAP configurations. If you can not upgrade to this release yet, we recommend disabling LDAP referrals in all LDAP providers in all of your realms. For detailed upgrade instructions, review the upgrading guide. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #44478 CVE-2025-13467 Deserialization of untrusted data in ldap user federation Bugs #43323 Sessions not removed when user is deleted infinispan #43738 UPDATE_EMAIL action invalidates old email login/ui #43754 Flaky test: org.keycloak.testsuite.federation.ldap.LDAPProvidersIntegrationTest#updateLDAPUsernameTest ci #43812 Admin console sends non-JSON payload with content-type: application/json admin/ui #44125 Double-encoding of query parameter values (e.g. acr_values) for version 26.4 identity-brokering #44187 [Keycloak Docs CI] Broken links docs #44189 [jdbc-ping] SQLIntegrityConstraintViolationException: Duplicate entry infinispan #44229 Unexpected FORMAT_FAILURE error when using cache-config-file with feature-disabled=persistent-user-sessions infinispan #44269 Admin Client creates malformed paths for requests admin/client-js #44287 Caching of static theme resources in dev mode is disabled core ## Keycloak 26.4.5 released DevFeed: [Keycloak 26.4.5 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-12T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [changelog]() Tags: [authorization](), [bugs](), [ci](), [docs](), [download](), [email](), [idm](), [import](), [jpa](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [ordering](), [quarkus](), [release](), [saml](), [sso](), [ui]() ### AI overview Keycloak 26.4.5 was released on November 12, 2025. The release page links to downloads and a migration guide and lists resolved issues involving tests, documentation, JPA, email persistence, database migration, authorization policies, attribute ordering, Quarkus builds, URL normalization, and the Admin Console. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #42601 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP ci #43212 Document missing artifact dependency for UserStoragePrivateUtil docs #43564 Invalid liquibase check sum for jpa-changelog-2.5.0.xml core #43718 Email Not Persisted During Registration When "Email as Username" is Enabled and User Edit Permission is Disabled user-profile #43793 import does not seem to run db migration import-export #43883 Creating group policy on a client uses "manage-clients" role if FGAP V1 is disabled authorization-services #44010 Ordering attributes will unset the unmanaged attribute policy user-profile #44031 Can't build keycloak 26.4.4 with quarkus.launch.rebuild=true dist/quarkus #44056 Allow only normalized URLs in requests caused a regression in view authz permission details in Admin Consol admin/ui #44117 DockerClientTest failure testsuite ## Keycloak 26.4.4 released DevFeed: [Keycloak 26.4.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-11-07T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [version](), [OpenID connect (OIDC)](), [LDAP](), [Quarkus]() Tags: [changes](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [quarkus](), [release](), [saml](), [sso](), [version]() ### AI overview Keycloak 26.4.4 is released with enhancements and fixes covering client-scope discovery, verification-email rate limiting, workflow authorization, fine-grained permissions, OIDC, LDAP, WebAuthn, memory usage, and other administration and infrastructure issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #10388 Allow to hide client scopes from scopes_supported in discovery endpoint #43076 Add rate limiter for sending verification emails in context of update email #43509 Role authorization for workflows. admin/api Bugs #41270 Cannot save new attribute group admin/ui #41271 Changing user profile attribute results in an error everytime admin/ui #43082 ExternalLinksTest is broken due to missing path parameters docs #43091 Duplicate Email Fields on Temporarily Locked Out Sign In With Organization Identity-First Login login/ui #43160 Regression in DEBUG_PORT handling since 26.4.0 - host binding (*:port / 0.0.0.0:port) no longer works dist/quarkus #43460 FGAP/UI: `reset-password` succeeds but UI shows 403 without Users:manage admin/fine-grained-permissions #43505 DPoP proof replay check doesn't consider clock skew oidc #43516 Deleting Client is slow and fails when a lot of client sessions exist core #43578 "admin" client role now requires server admin user admin/api #43579 403 Forbidden when assigning realm-management client roles with realm-admin despite FGAP disabled (regression in 26.4.0+) admin/fine-grained-permissions #43596 FGAP: user can no longer open account management page, broken by `reset-password` admin/fine-grained-permissions #43621 Version 26.4.1 breaks existing ldap users with capital letters in username ldap #43682 When syncing roles, the database layer can see deadlocks #43698 Role Mapper is updating the user every time on login identity-brokering #43723 Only add the none verifier when attestation conveyance preference is none (or default) authentication/webauthn #43734 Refresh token allowed for offline session even the related scope is removed #43736 FGAP V2: reset-password scope error when viewing users with Group permissions only core #43744 Increased memory usage due to leaking Keyc ## Keycloak 26.4.2 released DevFeed: [Keycloak 26.4.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-10-23T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [upgrade](), [version](), [OpenID connect (OIDC)](), [SPIFFE](), [PostgreSQL]() Tags: [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [postgresql](), [release](), [saml](), [spiffe](), [sso](), [upgrade](), [version](), [vulnerability]() ### AI overview Keycloak 26.4.2 was released on October 23, 2025. The release includes documentation and user-profile enhancements, SPIFFE support for an OIDC JWK endpoint, and fixes for CI, authentication, identity brokering, admin UI, documentation links, and graceful server shutdown. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #42991 Final review and update for UPDATE_EMAIL documentation docs #43351 Make pending email verification attribute removable by admin user-profile #43650 SPIFFE should support OIDC JWK endpoint Bugs #26374 Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode ci #30939 Vulnerability in brute force detection settings authentication #43022 Incorrect Basic Auth encoding for OIDC IDentity Provider when Client ID contains colon identity-brokering #43191 Upgrade guide for 26.4.0 should mention new minimal PostgreSQL server version 13 requirement docs #43244 UI crash on admin `/users/add-user` since 26.4.0 admin/ui #43544 Intra-document links not rendered in downstream docs #43561 Server does not shutdown gracefully when started with --optimized core ## Keycloak 26.4.1 released DevFeed: [Keycloak 26.4.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-10-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [Release notes](), [Security]() Tags: [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [race-condition](), [release](), [release-notes](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.4.1 is released with a new security-related feature, enhancements, and fixes across authentication, authorization, administration, user profiles, LDAP, documentation, sessions, and other components. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues New features #43020 Secure Client-Initiated Renegotiation - disable by default dist/quarkus Enhancements #42990 Hide read-only email attribute in update profile context with update email enabled user-profile #43357 JDBC_PING should publish its physical address on startup Bugs #40965 Group permission denies to view user admin/fine-grained-permissions #41292 openid-connect flow is missing response type on language change authentication #42565 Standard Token Exchange: chain of exchanges eventually fails token-exchange #42676 Security Defenses realm settings lost when switching between Headers and Brute Force Detection tabs (v25+) admin/ui #42907 Race condition in authorization service leads to NullPointerException when evaluating permissions during concurrent resource deletion authorization-services #43042 Avoid NPE in FederatedJWTClientAuthenticator when checking for supported assertion types core #43070 Update email page with pending verification email messages prefilled with old email user-profile #43096 keycloak-operator 26.4.0 missing clusterrole permissions docs #43104 Release notes fix for update email docs #43161 Restarting an user session broken for persistent sessions infinispan #43164 Keycloak docs state that only TLSv1.3 is used docs #43218 Cannot revoke access token generated by Standard Token Exchange oidc #43254 Make sure username and email attributes are lower cased when fetching their values from LDAP object ldap #43269 Keycloak 26.4 returns a different error response on a token request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc #43270 Keycloak 26.4 returns a different error response on a CIBA backchannel authentication request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does oidc #43286 Broken links on DB s [Next page]()