Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #50996](https://github.com/href="https://github.com/keycloak/keycloak/issues/50996">/issues/50996) [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption)
oidc - #51278](https://github.com/href="https://github.com/keycloak/keycloak/issues/51278">/issues/51278) [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes
oidc - #51280](https://github.com/href="https://github.com/keycloak/keycloak/issues/51280">/issues/51280) [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes
authorization-services - #51281](https://github.com/href="https://github.com/keycloak/keycloak/issues/51281">/issues/51281) [CVE-2026-18207] Source-group condition matches duplicate group names and can skip negative-logic enforcement
oidc - #51284](https://github.com/href="https://github.com/keycloak/keycloak/issues/51284">/issues/51284) [CVE-2026-18208] Inactive out-of-audience introspection responses can include a signed JWT claim
oidc - #51285](https://github.com/href="https://github.com/keycloak/keycloak/issues/51285">/issues/51285) [CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains
oidc - #51781](https://github.com/href="https://github.com/keycloak/keycloak/issues/51781">/issues/51781) [CVE-2026-18217] SAML Redirect Binding Parameter Pollution
saml - #52531](https://github.com/href="https://github.com/keycloak/keycloak/issues/52531">/issues/52531) CVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer
dependencies - #52692](https://github.com/href="https://github.com/keycloak/keycloak/issues/52692">/issues/52692) [CVE-2026-89298] Confidential client secret disclosed to view-clients role via Client Registration GET
oidc - #52783](https://github.com/href="https://github.com/keycloak/keycloak/issues/52783">/issues/52783) [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts (sibling of CVE-2026-9798)
oidc - #52888](https://github.com/href="https://github.com/keycloak/keycloak/issues/52888">/issues/52888) CVE-2026-84939 org.freemarker:freemarker
- #52972](https://github.com/href="https://github.com/keycloak/keycloak/issues/52972">/issues/52972) CVE-2026-8798 org.bouncycastle:bc-fips
dependencies - #52974](https://github.com/href="https://github.com/keycloak/keycloak/issues/52974">/issues/52974) CVE-2026-13505 org.bouncycastle:bc-fips
dependencies - #53074](https://github.com/href="https://github.com/keycloak/keycloak/issues/53074">/issues/53074) [CVE-2026-93999] Keycloak 26.7.2: token-exchange refresh continues issuing tokens for a disabled audience client
token-exchange
Weaknesses
- #51340](https://github.com/href="https://github.com/keycloak/keycloak/issues/51340">/issues/51340) DCR: Registration access token allows protocol switch from OIDC to SAML
oidc - #53024](https://github.com/href="https://github.com/keycloak/keycloak/issues/53024">/issues/53024) check-licenses.sh: shell injection via source of dependency pom.properties
Enhancements
- #52357](https://github.com/href="https://github.com/keycloak/keycloak/issues/52357">/issues/52357) Upgrade to Quarkus 3.33.4
dist/quarkus
Bugs
- #50739](https://github.com/href="https://github.com/keycloak/keycloak/issues/50739">/issues/50739) keycloak 26.7.0 sha1 file is missing
dist/quarkus - #50903](https://github.com/href="https://github.com/keycloak/keycloak/issues/50903">/issues/50903) Missing input length validation on username field causes outsized log generation in /login-actions/authenticate
authentication - #51065](https://github.com/href="https://github.com/keycloak/keycloak/issues/51065">/issues/51065) Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testPostAuthenticationNotAllowedWhenBasicRequested
ci - #51067](https://github.com/href="https://github.com/keycloak/keycloak/issues/51067">/issues/51067) Flaky test: org.keycloak.testsuite.oauth.ClientAuthPostMethodTest#testBasicAuthenticationNotAllowedWhenPostRequested
ci - #51304](https://github.com/href="https://github.com/keycloak/keycloak/issues/51304">/issues/51304) Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore.
infinispan - #51761](https://github.com/href="https://github.com/keycloak/keycloak/issues/51761">/issues/51761) PAR request URI lifespan is used as a hard cap on interactive login duration
oidc - #51778](https://github.com/href="https://github.com/keycloak/keycloak/issues/51778">/issues/51778) [quarkus-next] BouncyCastle 1.85 breaks SAML client creation when client ID exceeds 64 characters
dist/quarkus - #52033](https://github.com/href="https://github.com/keycloak/keycloak/issues/52033">/issues/52033) Improve retrieval of large read-only resources via admin API
storage - #52088](https://github.com/href="https://github.com/keycloak/keycloak/issues/52088">/issues/52088) New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts
infinispan - #52153](https://github.com/href="https://github.com/keycloak/keycloak/issues/52153">/issues/52153) DEBUG logging breaks persistent client session locking
storage - #52193](https://github.com/href="https://github.com/keycloak/keycloak/issues/52193">/issues/52193) Identity Provider Mappers - organization group targets do not resolve
organizations - #52257](https://github.com/href="https://github.com/keycloak/keycloak/issues/52257">/issues/52257) Event listeners receive the wrong event type when an EventBuilder is reused (e.g. FEDERATED_IDENTITY_LINK is logged and emailed as LOGIN)
core - #52309](https://github.com/href="https://github.com/keycloak/keycloak/issues/52309">/issues/52309) Admin Permissions filtering is applied to organization lookups during end-user authentication
organizations - #52327](https://github.com/href="https://github.com/keycloak/keycloak/issues/52327">/issues/52327) surefire-junit-platform not cached, causing intermittent test failures in CI
ci - #52329](https://github.com/href="https://github.com/keycloak/keycloak/issues/52329">/issues/52329) Flaky test: FlowTest.testRemoveExecutionSubflow fails with stale DELETE admin event
testsuite - #52331](https://github.com/href="https://github.com/keycloak/keycloak/issues/52331">/issues/52331) Flaky SCIM FilterTest.testFilterGroupsByMetaTimestamps due to same-millisecond timing
saml - #52415](https://github.com/href="https://github.com/keycloak/keycloak/issues/52415">/issues/52415) Flaky test: WebAuthnTransportLocaleTest.localizationTransportInternal fails with "Cannot logout user"
testsuite - #52423](https://github.com/href="https://github.com/keycloak/keycloak/issues/52423">/issues/52423) Flaky test: MySQLDistTest fails with "process hasn't exited" on slow CI runners
testsuite - #52428](https://github.com/href="https://github.com/keycloak/keycloak/issues/52428">/issues/52428) Flaky test: AttackDetectionResourceTest due to DefaultBlockingBruteForceProtector concurrent login blocking
authentication - #52433](https://github.com/href="https://github.com/keycloak/keycloak/issues/52433">/issues/52433) Flaky test: registration-policies.spec.ts kebab menu "Delete" item not found after toggle click
testsuite - #52435](https://github.com/href="https://github.com/keycloak/keycloak/issues/52435">/issues/52435) Flaky test: timeout.spec.ts fails with "fetch failed" due to server not ready and hardcoded port
testsuite - #52460](https://github.com/href="https://github.com/keycloak/keycloak/issues/52460">/issues/52460) Remove azure-cli version pin after runner image update removes apt source
ci - #52487](https://github.com/href="https://github.com/keycloak/keycloak/issues/52487">/issues/52487) Managing Identity Providers in the admin UI now requires client roles in the realm
admin/ui - #52490](https://github.com/href="https://github.com/keycloak/keycloak/issues/52490">/issues/52490) Flaky Admin UI E2E test: "Should show items on next page" in scope.spec.ts
ci - #52493](https://github.com/href="https://github.com/keycloak/keycloak/issues/52493">/issues/52493) AuroraDB IT - Create EC2 runner instance fails: RHEL 9.4 AMI deregistered
ci - #52712](https://github.com/href="https://github.com/keycloak/keycloak/issues/52712">/issues/52712) WebAuthnPolicyComplianceTest.replayedCredentialRegistration is flaky due to missing sync point
authentication - #52716](https://github.com/href="https://github.com/keycloak/keycloak/issues/52716">/issues/52716) Flaky CI: junit-jupiter-engine not in Maven cache causes transient test failures
ci - #52868](https://github.com/href="https://github.com/keycloak/keycloak/issues/52868">/issues/52868) Flaky test: RecoveryAuthnCodesAuthenticatorTest#test07SetupRecoveryAuthnCodes on Chrome
testsuite - #53054](https://github.com/href="https://github.com/keycloak/keycloak/issues/53054">/issues/53054) ServerConfigClassOrderer comparator violates Comparable contract causing flaky CI failures
testsuite - #53069](https://github.com/href="https://github.com/keycloak/keycloak/issues/53069">/issues/53069) Format string mismatches in logging statements cause silent argument loss and potential MissingFormatArgumentException
core
