Keycloak - Package Updates

[Package Updates]

[1.6.4]

• Update keycloak to 26.6.4
• Full Changelog
• #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
• #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
• #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
• #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
• #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
• #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
• #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison
• #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion
• #50100 Upgrade to Quarkus 3.33.2.1
• #49700 Incorrect migration guide reference docs

[Package Updates]

[1.7.0]

• Update keycloak to 26.7.0
• Full Changelog
• #49427 [CVE-2026-9796] Admin role rename TOCTOU bypasses checkAdminRoles realm-wide escalation from manage-clients admin/rbac
• #49430 [CVE-2026-9689] HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication oidc
• #49432 [CVE-2026-9798] CIBA authentication flow bypasses brute-force account lockout oidc
• #49766 [CVE-2026-11986] FGAP v1 allows unassigning any role admin/fine-grained-permissions
• #44013 Deprecate the Twitter IDP implementation due to old twitter4j library identity-brokering
• #48104 Remove support for token-exchange-external-internal:v2 token-exchange/federated
• #49270 Remove the batching option for the persistent sessions
• #46543 Step-up authentication for SAML - supported authentication
• #35650 Compatibility profiles
• #20128 Add support for reencrypt OpenShift Routes to the Operator operator

[Package Updates]

[1.7.1]

• Update keycloak to 26.7.1
• Full Changelog
• [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc (#49429)
• [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api (#50445)
• [CVE-2026-14209] Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under FGAP v2 admin/fine-grained-permissions (#50569)
• [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions (#50615)
• [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions (#50617)
• WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn (#50719)
• Kustomize cluster-wide faulty Role&RoleBinding operator (#50836)
• New Password is commited when multiple Password Reset is detected authentication (#50850)
• 500 when client requests organization scope with it already set to Default authentication (#50882)
• IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core (#50928)

[Package Updates]

[1.7.2]

• Update keycloak to 26.7.2
• Full Changelog
• #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies
• #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions
• #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix
• #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions
• #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc
• #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client
• #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass
• #51344 Upgrade to Quarkus 3.33.3.1
• #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication
• #51323 Custom realm-level role named admin cannot be updated in non-master realms after Keycloak 26.7.0 admin/rbac

[Package Updates]

[1.7.3]

• Update keycloak to 26.7.3
• Full Changelog
• #50785 CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
• #50997 [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
• #51003 [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc
• #51745 [CVE-2026-19729] Incomplete fix for CVE-2026-9083 relative path traversal still enables filesystem probing in 26.6.4 core
• #50825 Creating an organization without a domain leads to an error organizations
• #50963 V1 token-exchange strips the DPoP sender-constraint from a bound access token token-exchange
• #51510 SQLGrammarException: The incoming request has too many parameters core
• #51523 Sustained high CPU on all nodes after upgrade admin/api
• #51554 Admin API per-request cost grows super-linearly with realm count since 26.7.1 admin/api
• #51589 NPE in RoleUtils.expandCompositeRoles when a cached client scope references a deleted role core

[Package Updates]

[1.7.4]

• Update keycloak to 26.7.4
• Full Changelog
• #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
• #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
• #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
• #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
• #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
• #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state
• #52354 Upgrade to Quarkus 3.33.3.2 dist/quarkus
• #49635 Performance issue with 26.6.2 dist/quarkus
• #52172 Cached RealmAdapter.isUserManagedAccessAllowed() returns isEnabled() infinispan
• #52241 Clicking on a sub group in the admin console throws an exception admin/ui

[Package Updates]

[1.7.5]

• Update keycloak to 26.7.5
• Full Changelog
• Before upgrading refer to the migration guide for a complete list of changes.
• #50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc
• #51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc
• #51284 [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim oidc
• #52692 [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET oidc
• #53074 [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client token-exchange
• #52357 Upgrade to Quarkus 3.33.4 dist/quarkus
• #51304 Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore. infinispan
• #52088 New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts infinispan
• #52487 Managing Identity Providers in the admin UI now requires client roles in the realm admin/ui

[Package Updates]

[1.8.0]

• Update keycloak to 26.8.0
• Full Changelog
• Issue and verify digital wallet credentials with OID4VCI and OID4VP
• Automate user provisioning across identity systems with the SCIM API
• Run multi-cluster deployments without an external cache using stateless mode (now supported)
• Token exchange delegation for AI agents and automation with consent and FGAP authorization
• Multi-cluster v1 (the multi-site feature) is deprecated and will be removed in a future major release.
• Brute force detection data is now persisted in the database by default, so temporarily locked-out users remain locked out across cluster restarts.
• #50444 [CVE-2026-12388] IdP mapper admin role escalation identity-brokering
• #50618 [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified oidc
• #16738 Supported client secret rotation
• #52574 Regression in 26.7.0: DefaultClientSessionContext.getScopeString() no longer attaches "openid" scope on token refresh when the client omits it from the request oidc

[Package Updates]

[1.8.1]

• Update keycloak to 26.8.1
• Full Changelog
• #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
• #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
• #53354 SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering
• #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api
• #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
• #52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
• #53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
• #53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
• #53824 JGroups certificate reload blocks the view handling thread and hides task failures infinispan
• #53825 JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled infinispan

[Package Updates]

[1.8.2]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise