Keycloak Files

Identity and access management for modern applications and services

This is an exact mirror of the Keycloak project, hosted at https://github.com/keycloak/keycloak. SourceForge is not affiliated with Keycloak.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
third-party-notice-keycloak.html	2026-09-16	7.4 MB	0
keycloak-documentation-26.7.4.zip.asc	2026-09-16	228 Bytes	0
keycloak-ui-shared-26.7.4.tgz	2026-09-16	86.1 kB	0
keycloak-admin-ui-26.7.4.tgz	2026-09-16	3.8 MB	0
keycloak-api-docs-26.7.4.zip	2026-09-16	33.6 MB	0
keycloak-api-docs-26.7.4.zip.asc	2026-09-16	228 Bytes	0
keycloak-documentation-26.7.4.zip	2026-09-16	27.8 MB	0
keycloak-26.7.4.tar.gz	2026-09-16	176.5 MB	0
keycloak-26.7.4.tar.gz.asc	2026-09-16	228 Bytes	0
keycloak-26.7.4.zip	2026-09-16	176.7 MB	0
keycloak-26.7.4.zip.asc	2026-09-16	228 Bytes	0
keycloak-account-ui-26.7.4.tgz	2026-09-16	788.9 kB	0
keycloak-admin-client-26.7.4.tgz	2026-09-16	78.7 kB	0
26.7.4 source code.tar.gz	2026-09-16	48.4 MB	0
26.7.4 source code.zip	2026-09-16	59.3 MB	0
README.md	2026-09-16	4.5 kB	0
Totals: 16 Items		534.4 MB	0

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

#52834](https://github.com/href="https://github.com/keycloak/keycloak/issues/52834">/issues/52834) [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
#52835](https://github.com/href="https://github.com/keycloak/keycloak/issues/52835">/issues/52835) [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
#52836](https://github.com/href="https://github.com/keycloak/keycloak/issues/52836">/issues/52836) [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
#52837](https://github.com/href="https://github.com/keycloak/keycloak/issues/52837">/issues/52837) [CVE-2026-19607] Username Takeover Leading to Account Lockout
#52838](https://github.com/href="https://github.com/keycloak/keycloak/issues/52838">/issues/52838) [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
#52839](https://github.com/href="https://github.com/keycloak/keycloak/issues/52839">/issues/52839) [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state

Enhancements

#52354](https://github.com/href="https://github.com/keycloak/keycloak/issues/52354">/issues/52354) Upgrade to Quarkus 3.33.3.2 dist/quarkus

Bugs

#49635](https://github.com/href="https://github.com/keycloak/keycloak/issues/49635">/issues/49635) Performance issue with 26.6.2 dist/quarkus
#51102](https://github.com/href="https://github.com/keycloak/keycloak/issues/51102">/issues/51102) Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest ci
#52015](https://github.com/href="https://github.com/keycloak/keycloak/issues/52015">/issues/52015) New links errors for https://quarkus.io/guides docs
#52172](https://github.com/href="https://github.com/keycloak/keycloak/issues/52172">/issues/52172) Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()` infinispan
#52173](https://github.com/href="https://github.com/keycloak/keycloak/issues/52173">/issues/52173) `realm_client` is computed into a client's attributes and then persisted on save admin/api
#52233](https://github.com/href="https://github.com/keycloak/keycloak/issues/52233">/issues/52233) Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout dist/quarkus
#52241](https://github.com/href="https://github.com/keycloak/keycloak/issues/52241">/issues/52241) Clicking on a sub group in the admin console throws an exception admin/ui
#52283](https://github.com/href="https://github.com/keycloak/keycloak/issues/52283">/issues/52283) Flaky test SessionRestServiceTest.testGetDevicesSessions testsuite
#52430](https://github.com/href="https://github.com/keycloak/keycloak/issues/52430">/issues/52430) Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite testsuite

Source: README.md, updated 2026-09-16

Other Useful Business Software

$300 Free Credits to Build on Google Cloud Icon

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Build Data Resilience - Take the Assessment Today Icon

Build Data Resilience - Take the Assessment Today

Can you recover when it matters most? Take this quick assessment to identify gaps and build greater recovery confidence.

Is your recovery strategy as strong as you think? Take this quick self-assessment to check your recovery readiness and gain tailored insights. In only 2 minutes, you'll learn where you fall on the recovery readiness scale.

Take the Assessment

$300 Free Credits to Build on Google Cloud

New customers can spin up VMs, build with AI, and query data at no cost.

Put your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.

Start Free

Recommended Projects

Pocket ID
Easy-to-use OIDC provider that allows to authenticate with passkeys
hydra
Cloud native, security-first, API security for your infrastructure
pkcs11.net
Pkcs11 wrapper for .Net, written in C#. Supported Methods: TokeInfo/SlotInfo, Open/Close Session, Login/Logout, Find Objects, Digest, Sign/Verify, Encrypt/Decrypt
Dashy
A self-hostable personal dashboard built for you
EasyAuth
Create a centralized Authentication and Authorization token server