Keycloak Files

Identity and access management for modern applications and services

This is an exact mirror of the Keycloak project, hosted at https://github.com/keycloak/keycloak. SourceForge is not affiliated with Keycloak.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
third-party-notice-keycloak.html	2026-08-31	7.4 MB	0
keycloak-documentation-26.7.3.zip.asc	2026-08-31	228 Bytes	0
keycloak-ui-shared-26.7.3.tgz	2026-08-31	86.1 kB	0
keycloak-admin-client-26.7.3.tgz	2026-08-31	78.7 kB	0
keycloak-admin-ui-26.7.3.tgz	2026-08-31	3.8 MB	0
keycloak-api-docs-26.7.3.zip	2026-08-31	33.6 MB	0
keycloak-api-docs-26.7.3.zip.asc	2026-08-31	228 Bytes	0
keycloak-documentation-26.7.3.zip	2026-08-31	27.8 MB	0
keycloak-26.7.3.tar.gz	2026-08-31	176.4 MB	0
keycloak-26.7.3.tar.gz.asc	2026-08-31	228 Bytes	0
keycloak-26.7.3.zip	2026-08-31	176.7 MB	0
keycloak-26.7.3.zip.asc	2026-08-31	228 Bytes	0
keycloak-account-ui-26.7.3.tgz	2026-08-31	788.9 kB	0
26.7.3 source code.tar.gz	2026-08-31	48.4 MB	0
26.7.3 source code.zip	2026-08-31	59.3 MB	0
README.md	2026-08-31	13.3 kB	0
Totals: 16 Items		534.4 MB	0

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

#50785](https://github.com/href="https://github.com/keycloak/keycloak/issues/50785">/issues/50785) CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname ldap
#50997](https://github.com/href="https://github.com/keycloak/keycloak/issues/50997">/issues/50997) [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers oidc
#50998](https://github.com/href="https://github.com/keycloak/keycloak/issues/50998">/issues/50998) [CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users organizations
#51001](https://github.com/href="https://github.com/keycloak/keycloak/issues/51001">/issues/51001) [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2 admin/fine-grained-permissions
#51002](https://github.com/href="https://github.com/keycloak/keycloak/issues/51002">/issues/51002) [CVE-2026-16105] Missing per-role authorization on RoleContainerResource composite endpoints admin/rbac
#51003](https://github.com/href="https://github.com/keycloak/keycloak/issues/51003">/issues/51003) [CVE-2026-16089] Authorization codes can be retargeted to another client session oidc
#51005](https://github.com/href="https://github.com/keycloak/keycloak/issues/51005">/issues/51005) [CVE-2026-16104] Authenticator config surfaces expose raw reCAPTCHA secrets admin/fine-grained-permissions
#51112](https://github.com/href="https://github.com/keycloak/keycloak/issues/51112">/issues/51112) [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles admin/fine-grained-permissions
#51142](https://github.com/href="https://github.com/keycloak/keycloak/issues/51142">/issues/51142) [CVE-2026-17059] Information disclosure: GET /roles/{role}/users returns user PII without the per-user view filter admin/fine-grained-permissions
#51279](https://github.com/href="https://github.com/keycloak/keycloak/issues/51279">/issues/51279) [CVE-2026-18218] Client not-before revocation is ignored when realm not-before is older but nonzero oidc
#51282](https://github.com/href="https://github.com/keycloak/keycloak/issues/51282">/issues/51282) [CVE-2026-18215] Microsoft external access-token exchange bypasses configured tenant token-exchange
#51283](https://github.com/href="https://github.com/keycloak/keycloak/issues/51283">/issues/51283) [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations organizations
#51286](https://github.com/href="https://github.com/keycloak/keycloak/issues/51286">/issues/51286) [CVE-2026-18209] Incomplete fix for redirect_uri OIDC response-parameter injection: forbidden-parameter check (commit 18832bca) inspects only the query string, not the URL fragment oidc
#51287](https://github.com/href="https://github.com/keycloak/keycloak/issues/51287">/issues/51287) [CVE-2026-18214] Google external access-token exchange bypasses hosted-domain restriction token-exchange
#51378](https://github.com/href="https://github.com/keycloak/keycloak/issues/51378">/issues/51378) [CVE-2026-18571] FGAP V2: Group assignment bypass during user creation (POST /users) allows adding unpermitted groups admin/fine-grained-permissions
#51379](https://github.com/href="https://github.com/keycloak/keycloak/issues/51379">/issues/51379) [CVE-2026-18572] UMA claim token can override the authorization time-policy clock authorization-services
#51380](https://github.com/href="https://github.com/keycloak/keycloak/issues/51380">/issues/51380) [CVE-2026-18573] Client access-type condition evaluates updates against the old client type oidc
#51382](https://github.com/href="https://github.com/keycloak/keycloak/issues/51382">/issues/51382) [CVE-2026-18570] Full-scope-disabled client policy validation can be bypassed by omitting fullScopeAllowed oidc
#51745](https://github.com/href="https://github.com/keycloak/keycloak/issues/51745">/issues/51745) [CVE-2026-19729] Incomplete fix for CVE-2026-9083 — relative path traversal still enables filesystem probing in 26.6.4 core
#52028](https://github.com/href="https://github.com/keycloak/keycloak/issues/52028">/issues/52028) [CVE-2026-79652] Keycloak jwt-bearer authorization grant does not enforce consentRequired oidc

Weaknesses

#50581](https://github.com/href="https://github.com/keycloak/keycloak/issues/50581">/issues/50581) Admin API: User/group role-mapping endpoints disclose hidden client role metadata under FGAP v2 admin/fine-grained-permissions
#50583](https://github.com/href="https://github.com/keycloak/keycloak/issues/50583">/issues/50583) Admin API: Composite role endpoints do not filter child roles by FGAP v2 view permission admin/fine-grained-permissions
#50990](https://github.com/href="https://github.com/keycloak/keycloak/issues/50990">/issues/50990) Admin UI extension effective-role endpoints disclose hidden composite roles admin/fine-grained-permissions
#51143](https://github.com/href="https://github.com/keycloak/keycloak/issues/51143">/issues/51143) Aggregate policy partial evaluation diverges from runtime semantics under FGAP v2 admin/fine-grained-permissions
#51144](https://github.com/href="https://github.com/keycloak/keycloak/issues/51144">/issues/51144) Partial evaluation misses ancestor group policies with extendChildren admin/fine-grained-permissions
#51202](https://github.com/href="https://github.com/keycloak/keycloak/issues/51202">/issues/51202) Client-protocol condition can be bypassed on admin client creation by omitting protocol oidc

Bugs

#50825](https://github.com/href="https://github.com/keycloak/keycloak/issues/50825">/issues/50825) Creating an organization without a domain leads to an error organizations
#50963](https://github.com/href="https://github.com/keycloak/keycloak/issues/50963">/issues/50963) V1 token-exchange strips the DPoP sender-constraint from a bound access token token-exchange
#51510](https://github.com/href="https://github.com/keycloak/keycloak/issues/51510">/issues/51510) SQLGrammarException: The incoming request has too many parameters core
#51523](https://github.com/href="https://github.com/keycloak/keycloak/issues/51523">/issues/51523) Sustained high CPU on all nodes after upgrade admin/api
#51554](https://github.com/href="https://github.com/keycloak/keycloak/issues/51554">/issues/51554) Admin API per-request cost grows super-linearly with realm count since 26.7.1 admin/api
#51589](https://github.com/href="https://github.com/keycloak/keycloak/issues/51589">/issues/51589) NPE in RoleUtils.expandCompositeRoles when a cached client scope references a deleted role core
#51602](https://github.com/href="https://github.com/keycloak/keycloak/issues/51602">/issues/51602) Invalid redirect on https://access.redhat.com/products/red-hat-single-sign-on/ docs
#51707](https://github.com/href="https://github.com/keycloak/keycloak/issues/51707">/issues/51707) Lightweight access token role resolution resolves all roles across all realms on every admin API request core
#51712](https://github.com/href="https://github.com/keycloak/keycloak/issues/51712">/issues/51712) Logout URL does not allow OIDC response parameters in its redirect_url oidc
#51780](https://github.com/href="https://github.com/keycloak/keycloak/issues/51780">/issues/51780) SSSD CI job fails: FreeIPA container crashes on ubuntu-24.04 runner image 20260810.271 ci
#51785](https://github.com/href="https://github.com/keycloak/keycloak/issues/51785">/issues/51785) Multiple CVEs inherited from Apache DS used for testing
#51790](https://github.com/href="https://github.com/keycloak/keycloak/issues/51790">/issues/51790) Java Distribution IT/UT (windows-latest, temurin, 21) times out regularly ci
#51792](https://github.com/href="https://github.com/keycloak/keycloak/issues/51792">/issues/51792) AsyncCommitIntegrator Aurora detection logs "ERROR: function aurora_version() does not exist" in the PostgreSQL server log on every startup
#51807](https://github.com/href="https://github.com/keycloak/keycloak/issues/51807">/issues/51807) Client scope boundary bypassed when resolving admin roles via KeycloakIdentity admin/fine-grained-permissions
#51902](https://github.com/href="https://github.com/keycloak/keycloak/issues/51902">/issues/51902) Index modifiers are not logged if an index is not created due to a threshold core
#51920](https://github.com/href="https://github.com/keycloak/keycloak/issues/51920">/issues/51920) Error: 1020-HY000: Record has changed since last read in table OFFLINE_CLIENT_SESSION
#51983](https://github.com/href="https://github.com/keycloak/keycloak/issues/51983">/issues/51983) [26.7.2] Regression in UI in JS keycloak-admin-client
#52017](https://github.com/href="https://github.com/keycloak/keycloak/issues/52017">/issues/52017) SAML ECP faultstring discloses client existence, incomplete fix of CVE-2026-9794 saml
#52038](https://github.com/href="https://github.com/keycloak/keycloak/issues/52038">/issues/52038) Client session note removals are not persisted with persistent user sessions core

Source: README.md, updated 2026-08-31

Other Useful Business Software

Ship Agents Faster Icon

Ship Agents Faster

Transform your applications and workflows into powerful agentic systems at global scale.

Gemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.

Start Free

$300 Free Credits to Build on Google Cloud Icon

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Ship Agents Faster

Transform your applications and workflows into powerful agentic systems at global scale.

Gemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.

Start Free

Recommended Projects

Pocket ID
Easy-to-use OIDC provider that allows to authenticate with passkeys
Makam
Simple command line driven Java program to allow you to record arbitrary events in a MySQL database. E.g. when a machine or a person logged on or off. Just call Makam at appropriate points in your login/logout scripts.
hydra
Cloud native, security-first, API security for your infrastructure
keycloak-config-cli
Import YAML/JSON-formatted configuration files into Keycloak
matrimonywebsite
This is a Matrimony Website