Keycloak Files

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

• #50945](https://github.com/href="https://github.com/keycloak/keycloak/issues/50945">/issues/50945) [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
• #51381](https://github.com/href="https://github.com/keycloak/keycloak/issues/51381">/issues/51381) [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
• #52321](https://github.com/href="https://github.com/keycloak/keycloak/issues/52321">/issues/52321) [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
• #53057](https://github.com/href="https://github.com/keycloak/keycloak/issues/53057">/issues/53057) [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
• #53060](https://github.com/href="https://github.com/keycloak/keycloak/issues/53060">/issues/53060) [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
• #53070](https://github.com/href="https://github.com/keycloak/keycloak/issues/53070">/issues/53070) [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
• #53071](https://github.com/href="https://github.com/keycloak/keycloak/issues/53071">/issues/53071) [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
• #53072](https://github.com/href="https://github.com/keycloak/keycloak/issues/53072">/issues/53072) [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
• #53073](https://github.com/href="https://github.com/keycloak/keycloak/issues/53073">/issues/53073) [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
• #53111](https://github.com/href="https://github.com/keycloak/keycloak/issues/53111">/issues/53111) [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
• #53112](https://github.com/href="https://github.com/keycloak/keycloak/issues/53112">/issues/53112) [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
• #53158](https://github.com/href="https://github.com/keycloak/keycloak/issues/53158">/issues/53158) [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
• #53159](https://github.com/href="https://github.com/keycloak/keycloak/issues/53159">/issues/53159) [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
• #53160](https://github.com/href="https://github.com/keycloak/keycloak/issues/53160">/issues/53160) [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
• #53187](https://github.com/href="https://github.com/keycloak/keycloak/issues/53187">/issues/53187) [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
• #53338](https://github.com/href="https://github.com/keycloak/keycloak/issues/53338">/issues/53338) [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
• #53388](https://github.com/href="https://github.com/keycloak/keycloak/issues/53388">/issues/53388) CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
• #53393](https://github.com/href="https://github.com/keycloak/keycloak/issues/53393">/issues/53393) Multiple CVEs in tools.jackson.core:jackson-databind dependencies
• #53419](https://github.com/href="https://github.com/keycloak/keycloak/issues/53419">/issues/53419) [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
• #53582](https://github.com/href="https://github.com/keycloak/keycloak/issues/53582">/issues/53582) Multiple CVEs in simple-git dependencies
• #53659](https://github.com/href="https://github.com/keycloak/keycloak/issues/53659">/issues/53659) Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
• #53674](https://github.com/href="https://github.com/keycloak/keycloak/issues/53674">/issues/53674) [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api

Weaknesses

• #49009](https://github.com/href="https://github.com/keycloak/keycloak/issues/49009">/issues/49009) DockerEndpoint does not validate invalidRequestMessage after parsing authorization request oidc
• #49786](https://github.com/href="https://github.com/keycloak/keycloak/issues/49786">/issues/49786) Organizations: Invitation link can be used by multiple users due to missing single-use check organizations
• #51312](https://github.com/href="https://github.com/keycloak/keycloak/issues/51312">/issues/51312) refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation oidc
• #51887](https://github.com/href="https://github.com/keycloak/keycloak/issues/51887">/issues/51887) Username enumeration via empty-password timing authentication
• #52063](https://github.com/href="https://github.com/keycloak/keycloak/issues/52063">/issues/52063) Ensure max consumed respone size is respected for OCSP and CRLs authentication
• #52680](https://github.com/href="https://github.com/keycloak/keycloak/issues/52680">/issues/52680) Kerberos TRACE logging records complete SPNEGO credentials authentication
• #52982](https://github.com/href="https://github.com/keycloak/keycloak/issues/52982">/issues/52982) Non-critical X.509 KeyUsage mismatch bypasses authentication policy authentication
• #52984](https://github.com/href="https://github.com/keycloak/keycloak/issues/52984">/issues/52984) SimpleHttpResponse connection pool leak in identity brokering flows identity-brokering
• #53079](https://github.com/href="https://github.com/keycloak/keycloak/issues/53079">/issues/53079) Dynamic client registration self-enables privileged SSF event access oidc
• #53116](https://github.com/href="https://github.com/keycloak/keycloak/issues/53116">/issues/53116) SAML SLO: unauthenticated arbitrary session termination via LogoutRequest (SessionIndex) saml
• #53354](https://github.com/href="https://github.com/keycloak/keycloak/issues/53354">/issues/53354) SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering
• #53417](https://github.com/href="https://github.com/keycloak/keycloak/issues/53417">/issues/53417) FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
• #53430](https://github.com/href="https://github.com/keycloak/keycloak/issues/53430">/issues/53430) Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener) storage
• #53494](https://github.com/href="https://github.com/keycloak/keycloak/issues/53494">/issues/53494) SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check core
• #53693](https://github.com/href="https://github.com/keycloak/keycloak/issues/53693">/issues/53693) FGAP v2: non-imported LDAP users returned in search results for query-users-only delegated admins admin/fine-grained-permissions

Bugs

• #51268](https://github.com/href="https://github.com/keycloak/keycloak/issues/51268">/issues/51268) Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
• #52139](https://github.com/href="https://github.com/keycloak/keycloak/issues/52139">/issues/52139) Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
• #52362](https://github.com/href="https://github.com/keycloak/keycloak/issues/52362">/issues/52362) HttpServerUtil.sendResponse drops the headers it is given core
• #52449](https://github.com/href="https://github.com/keycloak/keycloak/issues/52449">/issues/52449) Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
• #52792](https://github.com/href="https://github.com/keycloak/keycloak/issues/52792">/issues/52792) Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
• #52927](https://github.com/href="https://github.com/keycloak/keycloak/issues/52927">/issues/52927) Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
• #53029](https://github.com/href="https://github.com/keycloak/keycloak/issues/53029">/issues/53029) Token introspection omits act claim for token-exchange delegation tokens token-exchange
• #53142](https://github.com/href="https://github.com/keycloak/keycloak/issues/53142">/issues/53142) Realm settings - security defenses admin/ui
• #53370](https://github.com/href="https://github.com/keycloak/keycloak/issues/53370">/issues/53370) RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
• #53467](https://github.com/href="https://github.com/keycloak/keycloak/issues/53467">/issues/53467) Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
• #53471](https://github.com/href="https://github.com/keycloak/keycloak/issues/53471">/issues/53471) Regression with Trust Email when the userinfo endpoint is used identity-brokering
• #53505](https://github.com/href="https://github.com/keycloak/keycloak/issues/53505">/issues/53505) Broken link to FIPS documentation docs
• #53567](https://github.com/href="https://github.com/keycloak/keycloak/issues/53567">/issues/53567) Broken link to vault documentation in downstream docs
• #53569](https://github.com/href="https://github.com/keycloak/keycloak/issues/53569">/issues/53569) Fix broken link to migrating the database in downstream docs
• #53571](https://github.com/href="https://github.com/keycloak/keycloak/issues/53571">/issues/53571) Broken link in Operator Guide docs
• #53624](https://github.com/href="https://github.com/keycloak/keycloak/issues/53624">/issues/53624) Multiple link issues including incorrect names and upstream only coding docs
• #53653](https://github.com/href="https://github.com/keycloak/keycloak/issues/53653">/issues/53653) Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
• #53660](https://github.com/href="https://github.com/keycloak/keycloak/issues/53660">/issues/53660) Flaky test: main.spec.ts 'Enable/disable help mode in desktop mode' fails with help label still visible admin/ui
• #53665](https://github.com/href="https://github.com/keycloak/keycloak/issues/53665">/issues/53665) Flaky test: PauseTest.testPause times out on slow runners — no wait for operator readiness ci
• #53757](https://github.com/href="https://github.com/keycloak/keycloak/issues/53757">/issues/53757) Broken EntityManager API link fails ExternalLinksTest testsuite
• #53824](https://github.com/href="https://github.com/keycloak/keycloak/issues/53824">/issues/53824) JGroups certificate reload blocks the view handling thread and hides task failures infinispan
• #53825](https://github.com/href="https://github.com/keycloak/keycloak/issues/53825">/issues/53825) JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled infinispan
• #53856](https://github.com/href="https://github.com/keycloak/keycloak/issues/53856">/issues/53856) JsonFileImport198MigrationTest fails: realm certificate expired on 2026-10-12 ci