# saml Published articles for saml. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Keycloak 26.7.4 released DevFeed: [Keycloak 26.7.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Quarkus](), [MariaDB](), [MySQL](), [saml]() Tags: [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [mariadb](), [mysql](), [openid-connect](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.4 was released on September 16, 2026. The release includes security fixes for several CVEs, an upgrade to Quarkus 3.33.3.2, and fixes for performance, testing, documentation, administration, and UI issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state Enhancements #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus Bugs #49635 Performance issue with 26.6.2 dist/quarkus #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci #52015 New links errors for https://quarkus.io/guides docs #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan #52173 `realm_client` is computed into a client's attributes and then persisted on save admin/api #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 -- SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus #52241 Clicking on a sub group in the admin console throws an exception admin/ui #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite ## How to answer the identity questions on an enterprise security questionnaire DevFeed: [How to answer the identity questions on an enterprise security questionnaire]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Security](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [App]() Tags: [configuration](), [enterprise](), [how-to](), [identity](), [integration](), [oidc](), [okta](), [provisioning](), [saml](), [security](), [sign-in](), [sso]() ### AI overview A practical guide to answering identity-related questions in enterprise security questionnaires. It explains what reviewers are really assessing behind SAML single sign-on and SCIM provisioning questions, including implementation details such as per-organization configuration, certificate rotation, and reliable deprovisioning. ### Source excerpt Every line has a literal answer and a real question behind it. Here is what the buyer is actually checking, which answers you can buy, and the three you cannot fake. ## Keycloak 26.7.3 released DevFeed: [Keycloak 26.7.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [JSON Web Tokens](), [LDAP](), [reCAPTCHA]() Tags: [2026](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [microsoft](), [oidc](), [openid-connect](), [recaptcha](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.3 was released on August 31, 2026. The release includes security fixes addressing LDAP certificate verification, signed-JWT assertion policies, authorization controls, information disclosure, token exchange restrictions, OIDC response-parameter injection, and related issues. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc #50998 [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations #51001 [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions #51002 [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc #51005 [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions #51112 [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions #51142 [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions #51279 [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc #51282 [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange #51283 [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations #51286 [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc #51287 [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange #5137 ## How to migrate from a custom auth system to a third-party provider DevFeed: [How to migrate from a custom auth system to a third-party provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [migration](), [passwords](), [Single sign-on (SSO)](), [saml]() Tags: [auth](), [how-to](), [migration](), [password](), [rollback](), [saml](), [sso](), [third-party]() ### AI overview A guide to moving from a custom authentication system to a third-party provider. It explains how password-hash portability, SSO callback control, and an inventory of existing authentication components determine the migration strategy and cutover plan. ### Source excerpt What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust. ## KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague DevFeed: [KEYCONF26 agenda and speakers announced for 8 October 2026 in Prague]() Original publisher: [Read original article]() Author: Alina Rudyk Published: 2026-08-23T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [identity and access management](), [openid](), [Security]() Tags: [iam](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [saml](), [security](), [sso](), [talk]() ### AI overview Keycloak has announced the speaker line-up and agenda for KEYCONF26, taking place in Prague on 8 October 2026. The programme covers Keycloak operations, extensions, identity standards, security, access tokens, and related use cases. ### Source excerpt The KEYCONF26 speaker line-up is taking shape, and this year's agenda is now live! 📍 KEYCONF26 is taking place in Prague on 8 October 2026. This October, the Keycloak community will come together once again for a full day of technical insights, real-world experiences and conversations around identity and access management. This year's programme brings together speakers from across the Keycloak ecosystem - from organisations running Keycloak in complex production environments to experts exploring new standards, architectures and use cases. Talk highlights The talks announced highlight the broad spectrum of the Keycloak ecosystem: how to run Keycloak securely and at scale, how to extend it, and how identity is evolving to support new technologies and use cases. Here are just a few highlights: What Role Can Keycloak Play for International Science? An Introduction to the OpenID Shared Signals Framework Keycloak becomes familiar with AI: the advancement of integrating Keycloak with AI Wicked Keycloak challenges and how to resolve them Token Hygiene - Why Your Keycloak Access Tokens Need a Diet And that is only a glimpse of what is waiting for you in Prague 👉 Explore the KEYCONF26 agenda announced: https://keyconf.dev/ A great place to network KeyConf is about more than the talks. It is also an opportunity to meet the people behind the technology, exchange experiences and connect with others working on similar identity challenges. Networking lunch Our extended lunch break gives you plenty of time to meet fellow attendees, swap ideas and continue conversations from the sessions in a relaxed setting. Meet the community KeyConf brings together Keycloak users, contributors, developers, architects, security specialists and IAM experts from different organisations and industries. Whether you want to discuss a challenge from your own Keycloak environment, exchange experiences or simply meet people from the community in person, there will be plenty of opportunities to connect thr ## Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM DevFeed: [Auth0 Enterprise Connect in beta vs. WorkOS for enterprise SSO and SCIM]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-21T00:00:00Z Content type: comparison Language: en Sources: [WorkOS Blog]() Topics: [Auth0](), [Single sign-on (SSO)](), [Provisioning](), [OpenID connect (OIDC)](), [saml](), [Security]() Tags: [auth0](), [enterprise](), [oidc](), [provisioning](), [saml](), [sso]() ### AI overview This comparison examines Auth0 Enterprise Connect, which is in beta, alongside WorkOS for enterprise SSO and SCIM. It explains how Auth0 preserves an existing authorization server while adding enterprise identity capabilities, and highlights differences in SCIM direction, plan tier, pricing, and access requirements. ### Source excerpt Auth0's beta keeps the authorization server you already run and adds the enterprise surface around it. The differences from WorkOS show up in SCIM direction, plan tier, and which pricing table you are actually reading. ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Keycloak Client Libraries 26.0.12 released DevFeed: [Keycloak Client Libraries 26.0.12 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Caching](), [Security](), [client](), [test]() Tags: [cache](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [openid-connect](), [resolved](), [saml](), [security](), [sso](), [test]() ### AI overview Keycloak Client Libraries 26.0.12 was released with security fix #234, which normalizes URIs so mutated URIs share the cache key of their canonical form, and bug fix #231 related to changed authentication resource behavior causing test failures. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #234 Normalize URIs in PathConfigMatcher to ensure mutated URIs share the same cache key as their canonical form client Bugs #231 AuthenticationManagementResource changed behavior causes test failures client ## The future of the Keycloak Discourse forum DevFeed: [The future of the Keycloak Discourse forum]() Original publisher: [Read original article]() Author: GR Patil, Niko Köbler Published: 2026-07-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [ai-coding](), [dev-tools](), [maintenance](), [Security]() Tags: [ai](), [ai-coding](), [developer-tools](), [idm](), [kerberos](), [keycloak](), [ldap](), [maintenance](), [openid-connect](), [saml](), [security](), [sso]() ### AI overview The Keycloak project announces that it will wind down its Discourse forum. The article explains the forum's historical role, increased use of AI coding assistants and search-like developer tools, reduced forum activity, and the maintenance effort required to keep it open. ### Source excerpt The Keycloak project has always relied on open, searchable, community-owned discussion. Over the years, the Keycloak Discourse forum has been an important part of that: a place where users could ask configuration questions, share migration experiences, debug integrations, and find answers from people who had solved similar problems before. After a lot of consideration, we have decided to wind down the Keycloak Discourse forum. This is not a decision we are taking lightly. The forum contains many years of useful community knowledge, and we recognize the role it has played for Keycloak users. We also recognize that previous changes to the forum caused disruption. For that reason, we want to explain why we are making this change, how it will happen, when it will happen, and where the community should go next. Why we are making this change In June 2023, the Keycloak maintainers decided to sunset Discourse as one of the project's communication channels. That decision was met with strong feedback from the community. Many users explained that Discourse filled an important role that was not fully covered by mailing lists, GitHub Discussions, or chat. After listening to that feedback, we reactivated Discourse in October 2023. In the years since, the way developers seek help has changed. More and more Keycloak users now turn first to AI coding assistants and search-like developer tools when they need help configuring Keycloak, troubleshooting integrations, or understanding errors. Those tools have almost certainly learned from many of the public sources the community has created over the years, including the Discourse forum, GitHub Discussions, mailing lists, documentation, blog posts, and issue trackers. That shift has changed the role of a community forum. The old model depended on a steady flow of new questions, answers, corrections, and follow-up discussion. Without that activity, the forum risks becoming a stale support archive rather than a healthy community space. Keep ## Enable Your SAML Requesting App for Cross App Access DevFeed: [Enable Your SAML Requesting App for Cross App Access]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OAuth 2.0](), [Authorization](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [API](), [AI Agent]() Tags: [api](), [authorization](), [claude](), [cross-app-access](), [digital-signature](), [identity](), [idp](), [implementation](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [payload](), [saml](), [signing](), [sso](), [xaa]() ### AI overview This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration. ### Source excerpt If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap ## Multi-Cluster v2 and Stateless Mode now in Preview DevFeed: [Multi-Cluster v2 and Stateless Mode now in Preview]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-07-17T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authentication](), [Database](), [Availability](), [Replication](), [Kubernetes](), [Amazon Web Services]() Tags: [authentication](), [availability](), [clustering](), [database](), [distributed](), [failover](), [idm](), [kerberos](), [ldap](), [monitoring](), [openid-connect](), [preview](), [replication](), [saml](), [sso]() ### AI overview Keycloak 26.7 introduces Stateless Mode as a preview. It moves volatile data, including authentication sessions, action tokens, and brute-force counters, from Infinispan caches to the database, supporting multi-cluster deployments without an external Infinispan cluster. ### Source excerpt Starting with Keycloak 26.7, the stateless feature is available as a preview. It fundamentally simplifies how Keycloak handles volatile data -- authentication sessions, action tokens, and brute-force counters move from embedded or external Infinispan caches to the database. The result: Keycloak deployments that are easier to operate, more resilient, and ready for multi-cluster setups without an external Infinispan cluster. Read on to learn more, and ask questions in our upcoming live Q&A event on Jul 21! The problem with the current approach A multi-cluster setup becomes necessary when no transparent networking between two sites is available for Keycloak's embedded Infinispan to form a single cluster -- for example, when sites are in different availability zones or data centers without a shared network layer. Running Keycloak in such a multi-cluster setup today requires significant infrastructure beyond Keycloak itself. Without the stateless feature, the architecture depends on an external Infinispan cluster with cross-datacenter replication channels, dedicated monitoring to detect and handle Infinispan failover, and operational procedures for failback. It was tied to specific environments like Kubernetes and AWS, and using it in other environments would require significant work to adapt it. Even in single-cluster deployments, Infinispan clustering introduces operational overhead: rebalancing data in distributed caches when a node is lost or restarted, and transient failures in login flows if a node unexpectedly disappears. In large installations, the login failure cache can grow significantly, consuming substantial memory and causing long rebalancing times when nodes join or leave the cluster. While distributed caches replicate data across at least two nodes -- so individual node failures do not lose data -- a full cluster restart during minor upgrades resets volatile state such as in-progress authentication sessions and brute-force counters. What changes with stateles ## Keycloak Client Libraries 26.0.11 released DevFeed: [Keycloak Client Libraries 26.0.11 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-15T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [client](), [servers](), [ci](), [migration]() Tags: [2026](), [bugs](), [changes](), [ci](), [client](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [resolved](), [saml](), [sso]() ### AI overview Keycloak Client Libraries 26.0.11 was released on July 15, 2026. The release notes mention an enhancement to sync after the Keycloak server 26.7.0 release and a CI failure issue in keycloak-client. Users are directed to the migration guide before upgrading. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #226 Sync after Keycloak server 26.7.0 release client Bugs #222 keycloak-client CI is failing client ## Keycloak 26.7.0 released DevFeed: [Keycloak 26.7.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-07-09T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [API](), [Authentication](), [Authorization](), [Security](), [OAuth 2.0](), [saml]() Tags: [api](), [authentication](), [authorization](), [deprecated](), [haproxy](), [high-availability](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid-connect](), [persistence](), [provisioning](), [release](), [saml](), [security](), [sso](), [traefik]() ### AI overview Keycloak 26.7.0 introduces preview support for SCIM-based user provisioning and simplified multi-cluster high availability, along with enhanced HAProxy and Traefik reverse-proxy guidance and step-up authentication for SAML clients. The release also adds a more secure, OAuth 2.0-compliant Identity Brokering API v2, while V1 remains enabled by default but is deprecated. OID4VCI improvements remain experimental. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: Automate user provisioning with the SCIM API (preview) Simplified multi-cluster high availability without external caches (preview) Enhanced reverse proxy guides with blueprints for HAProxy and Traefik Step-up authentication for SAML clients Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards Stronger security for the Identity Brokering API The Identity Brokering API allows applications to retrieve tokens obtained from external identity providers during federated login. Version 2 of this API replaces the legacy V1 with a more secure and standards-compliant design: Client-level authorization -- access to external tokens is controlled per client using dedicated settings (Allow retrieve external tokens and an identity provider allow list) instead of assigning broker roles to individual users. Confidential clients only -- public clients are rejected, ensuring that only authenticated clients can retrieve external tokens. OAuth 2.0 compliant -- the endpoint uses POST and returns standard JSON responses with access_token, error, and error_description fields. Session-based token storage -- a new Store token in session option keeps tokens in the user session for faster access, with automatic cleanup on session expiry. Database storage remains available for persistence across sessions. V2 is now supported but disabled by default. V1 is deprecated but still enabled by default for backward compatibility. In a future release, V1 will be removed and V2 will become the default. For more information, see the Identity Brokering APIs chapter in the Server Developer Guide. Progress on Verifiable Credentials (OID4VCI) (experimental) Verifiable Credentials (OID4VCI) allow organizations to issue tampe ## Experimental Shared Signals Framework support DevFeed: [Experimental Shared Signals Framework support]() Original publisher: [Read original article]() Author: Thomas Darimont Published: 2026-07-03T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [openid](), [Security](), [JSON Web Tokens](), [HTTP](), [Software as a service]() Tags: [experimental](), [http](), [idm](), [jwt](), [kerberos](), [keycloak](), [ldap](), [openid](), [openid-connect](), [release](), [saas](), [saml](), [security](), [sso]() ### AI overview Keycloak announces experimental support for the OpenID Shared Signals Framework 1.0 in its nightly release. It can transmit signed Security Event Tokens about identity-related events to subscribed receivers over standardized HTTP push or poll channels, enabling faster propagation of changes such as session revocation, account disabling, credential rotation, and device non-compliance. ### Source excerpt We are excited to announce that Keycloak now provides experimental support for the OpenID Shared Signals Framework 1.0 specification, available from today in the nightly release. This allows Keycloak to act as a Shared Signals Transmitter, pushing signed Security Event Tokens (SETs) about identity-relevant events to any subscribed Receiver, using a standardised wire format defined by the OpenID Foundation. This closes a long-standing gap. When you revoke a user's session in Keycloak today, the SaaS app they're logged into usually doesn't sign them out until their next token refresh, which can be minutes, hours, or in some cases never. The same gap exists when an account is disabled, a credential is rotated, or a device is flagged as non-compliant. Keycloak knows; the relying parties don't, until they happen to ask again. With SSF, Keycloak can now push those signals to subscribed receivers in seconds -- no per-vendor webhooks, no bespoke polling endpoints, no Kafka topic per integration. Concretely, this also unlocks an integration the Keycloak ecosystem has been missing: Keycloak can now act as the federated IdP for Apple Business and Apple School Manager, signalling user-state changes back to Apple so enrolled devices can ask the user to reauthenticate. This post is the first in a small series. It introduces SSF, walks through what's actually shipped in the experimental release, and outlines where we'd like to take it next. Follow-up posts will cover how to define custom events, how to emit synthetic events, and an Apple Business and Apple School Manager integration end to end. A short tour of Shared Signals The OpenID Foundation's Shared Signals Framework 1.0 defines a standard way for one party (the Transmitter) to tell another party (the Receiver) about identity-relevant events as they happen. Each event is delivered as a signed JWT, a Security Event Token (RFC 8417) delivered over either an HTTP push channel (RFC 8935) or an HTTP poll channel (RFC 8936). Two pr ## Keycloak Client Libraries 26.0.10 released DevFeed: [Keycloak Client Libraries 26.0.10 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [client](), [Keycloak](), [Documentation]() Tags: [bugs](), [changes](), [client](), [docs](), [guide](), [idm](), [kerberos](), [keycloak](), [keycloak-client-libraries-release](), [ldap](), [openid-connect](), [resolved](), [saml](), [sso]() ### AI overview Keycloak Client Libraries 26.0.10 was released on June 30, 2026. The release includes resolved issues involving supported Keycloak server versions and downstream documentation builds. ### Source excerpt Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #208 Clarification of supported keycloak server versions client #210 Latest changes break downstream docs build for 26.6 client ## Save the Date: Keycloak DevDay 2027 DevFeed: [Save the Date: Keycloak DevDay 2027]() Original publisher: [Read original article]() Author: Niko Köbler, Sebastian Rose Published: 2026-06-29T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Hackathon]() Tags: [2026](), [blog](), [community](), [conference](), [contributors](), [germany](), [hackathon](), [idm](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [saml](), [sessions](), [sso](), [submission](), [talks]() ### AI overview Keycloak DevDay 2027 will take place in Darmstadt, Germany, on April 8-9, 2027. The event will include a conference day with community talks and deep dives, followed by a community day with a hackathon and OpenSpace sessions. Ticket sales have not started, and the call for papers is planned for around the end of August. ### Source excerpt ‼ Mark your calendars! Keycloak DevDay 2027 is coming back to Darmstadt, Germany, on April 8-9, 2027 ‼ Like the previous edition, DevDay 2027 will span two days with the same overall structure - though with a few notable changes participants will notice: 📅 Thursday, April 8, 2027 - Conference Day: talks and deep dives from the Keycloak community and contributors. 📅 Friday, April 9, 2027 - Community Day: a more informal, hands-on day featuring a Hackathon and an OpenSpace with multiple breakout sessions, where attendees shape the agenda together. Stay in the loop Ticket sales haven't started yet, and we don't want you to miss your chance to grab one of the strictly limited seats. If you haven't already, subscribe to the newsletter on keycloak-day.dev to be the first to know the moment tickets go live. Call for Papers We're planning to open the Call for Papers around the end of August. Keep an eye on the newsletter and this blog for the exact date and submission details. Something to watch in the meantime While you wait, why not revisit the talks from past years editions? The full playlists of Keycloak DevDay videos are available on YouTube: Keycloak DevDay 2026 video playlist Keycloak DevDay 2025 video playlist Keycloak DevDay 2024 video playlist We can't wait to see you in Darmstadt next April! Niko & Sebastian ## Keycloak 26.6.4 released DevFeed: [Keycloak 26.6.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens](), [upgrade](), [Quarkus]() Tags: [2026](), [authentication](), [authorization](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [quarkus](), [reference](), [release](), [saml](), [security](), [sso](), [upgrade](), [xss]() ### AI overview Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus ## Meet Keycloak at KubeCon Japan in July DevFeed: [Meet Keycloak at KubeCon Japan in July]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-06-20T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [MCP](), [Authorization](), [agentic workflows]() Tags: [authorization](), [conference](), [event](), [idm](), [japan](), [kerberos](), [keycloak](), [kubecon](), [ldap](), [mcp](), [openid-connect](), [saml](), [sso]() ### AI overview The Keycloak project announces its participation in KubeCon Japan Yokohama in July 2026, including KeycloakCon, a community kiosk, and technical talks. Sessions will cover Keycloak's authorization support for MCP and cloud-native identity and access management patterns. ### Source excerpt The Keycloak project is back at KubeCon Japan Yokohama with all highlights: Talks, our kiosk in the Project Table, and this time also with KeycloakCon, our very-own co-located event! If you are new to Keycloak, or already a user, join us for this exciting event to learn and connect. Half-day KeycloakCon packed with all-things-Keycloak KeycloakCon is a co-located event happening on Tuesday, July 28 from 09:00 to 12:30. It brings together the Keycloak community with case studies and talks featuring the latest features. Join this event for technical talks, professional growth, and networking opportunities. Book your ticket as an add-on to the KubeCon + CloudNativeCon pass. Use the discount code KCJP26STKEYCC and save 280 USD on the combined offer of KeycloakCon and KubeCon! & & & & '' ## Keycloak 26.6.3 released DevFeed: [Keycloak 26.6.3 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-04T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [LDAP](), [saml](), [WebAuthn](), [Netty]() Tags: [cors](), [cve](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.6.3 is released with security fixes and other resolved weaknesses, including issues affecting OIDC, CORS, access control, LDAP federation, SAML, WebAuthn, and token handling. The article directs users to the Keycloak downloads and migration guide. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations #49433 [CVE-2026-9803] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc Weaknesses #48978 UNSAFE_PATH ## What SPIFFE Answers for Workload Identity and What It Doesn't DevFeed: [What SPIFFE Answers for Workload Identity and What It Doesn't]() Original publisher: [Read original article]() Author: info@goteleport.com (Rob Cobbins) Published: 2026-05-29T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Authorization](), [active directory](), [AWS IAM](), [passwd](), [OpenID connect (OIDC)](), [saml]() Tags: [active-directory](), [authorization](), [aws](), [identity](), [ldap](), [oidc](), [passwd](), [permissions](), [saml](), [spiffe]() ### AI overview This article examines what SPIFFE provides for workload identity and where it falls short. It argues that SPIFFE offers a sound way for machines to prove their identities without shared secrets, but does not define authorization and leaves workload registration largely to implementations. ### Source excerpt Learn about the workload identity questions SPIFFE can't answer and considerations for filling gaps in the spec. ## Meet Keycloak at KubeCon India in June DevFeed: [Meet Keycloak at KubeCon India in June]() Original publisher: [Read original article]() Author: Alexander Schwartz Published: 2026-05-26T00:00:00Z Content type: news Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Extension]() Tags: [community](), [contributors](), [extensions](), [idm](), [india](), [kerberos](), [keycloak](), [kubecon](), [ldap](), [maintainers](), [openid-connect](), [saml](), [sso]() ### AI overview Keycloak will participate in KubeCon + CloudNativeCon India 2026 in Mumbai on June 18-19. Attendees can meet Keycloak maintainers, contributors, and the wider community at the project table in the Project Pavilion. ### Source excerpt This year's KubeCon India is coming to Mumbai, and Keycloak will be part of this year's edition on June 18-19! Register today to get tickets! A lot of people use Keycloak and develop extensions in for Keycloak in India, so we are thrilled to connect with the community. ' '' ## Keycloak experimental AuthZEN Support DevFeed: [Keycloak experimental AuthZEN Support]() Original publisher: [Read original article]() Author: Ryan Emerson Published: 2026-05-20T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Authorization](), [openid](), [API](), [REST API](), [interoperability](), [vendor lock-in]() Tags: [authentication](), [changes](), [idm](), [interoperability](), [kerberos](), [keycloak](), [ldap](), [openid-connect](), [release](), [resource](), [rest-api](), [saml](), [sdks](), [sso](), [vendor-lock-in](), [works]() ### AI overview Keycloak announces experimental support for the OpenID AuthZEN Authorization API 1.0 specification starting with version 26.7.0. The feature lets Keycloak act as a Policy Decision Point and expose existing authorization policies through a standardized API for Policy Enforcement Points. ### Source excerpt We are excited to announce that from 26.7.0, Keycloak will include experimental support for the OpenID AuthZEN Authorization API 1.0 specification. This allows Keycloak to act as a Policy Decision Point (PDP), exposing its authorization capabilities through a standardized API that any Policy Enforcement Point (PEP) can consume. You can try this now with the Keycloak nightly release. Why AuthZEN? Authorization has long been fragmented, with competing systems defining their own protocols for answering the same fundamental question: "Can this subject perform this action on this resource?". This means applications are tightly coupled to whichever authorization backend they choose, and swapping providers requires rewriting integration code. AuthZEN changes this by defining a single, vendor-neutral API between the component that asks (the PEP) and the component that decides (the PDP). It is, in many ways, what OpenID Connect did for authentication -- but for authorization. With AuthZEN: No more vendor lock-in -- your application speaks one API regardless of the PDP behind it. RBAC, ABAC, and ReBAC under one roof -- different policy models can answer the same request format, enabling true interoperability across authorization paradigms. Centralized, externalized authorization -- policy logic lives in the PDP, not scattered across application code, making it easier to audit and update. Simpler integration -- a clean REST API with a minimal request/response model replaces complex, implementation-specific SDKs. A growing ecosystem OpenID AuthZEN Interop demonstrates that over a dozen independently-developed PDPs can be used interchangeably by the same PEP without changing a single line of application code. By adding AuthZEN support, Keycloak joins this ecosystem and lets you leverage your existing Keycloak policies through the same standardized API used by every other AuthZEN-compatible PDP. How it works The interaction between your application and Keycloak follows the standard PE ## Keycloak 26.6.2 released DevFeed: [Keycloak 26.6.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-05-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Vulnerabilities](), [Security](), [Authentication](), [OpenID connect (OIDC)](), [WebAuthn](), [XSS]() Tags: [2](), [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [permission](), [pii](), [release](), [saml](), [security](), [sso](), [vulnerability](), [xss]() ### AI overview Keycloak 26.6.2 is a security-focused release that fixes multiple vulnerabilities, including denial-of-service issues, request smuggling, access-control flaws, stored XSS, WebAuthn policy bypass, token disclosure, account takeover, and PII enumeration. It also includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn #48570 [CVE-2026-0636, CVE-2026-3505, CVE-2026-5598] Multiple bouncycastle CVEs core #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration Enhancements #47728 Monitor backups for CNPG - [Next page]()