Keycloak

26.7.1Security

Aug 5, 2026Copy link

Keycloak 26.7.1 is a security patch addressing five CVEs: OIDC request-object signature validation bypass, admin API privilege escalation, and three fine-grained admin permission (FGAP v2) bypasses. WebAuthn attachment policy enforcement is now mandatory. Several unrelated bugs affecting concurrent password reset, organization scope requests, and operator clustering are also fixed.

• securityJWE request object signature validation bypassed

  JWE-formatted request objects bypass signature algorithm enforcement, allowing attackers to submit unvalidated OIDC requests. The fix ships in v26.7.1.

• securityAdmin API privilege escalation via role mapper injection

  A hardcoded role mapper in the manage-clients admin API allows privilege escalation to admin roles. The fix ships in v26.7.1.

• securityAdmin UI user disclosure under FGAP v2

  The Admin UI Extension search function discloses user identities via search=id: queries when FGAP v2 is enabled (CVE-2026-14209). The fix ships in v26.7.1 and applies to deployments using fine-grained admin permissions.

• securityFGAP v2 client scope assignment bypass

  Fine-grained admin permissions are bypassed during client scope assignment, allowing unauthorized scope modifications (CVE-2026-14614). The fix ships in v26.7.1 and applies to deployments using FGAP v2.

• securityFGAP v2 group children permission bypass

  The parent group children endpoint returns all child groups without enforcing per-child view permission filters in FGAP v2 (CVE-2026-14615). The fix ships in v26.7.1 and applies to deployments using fine-grained admin permissions.

• breakingWebAuthn attachment policy bypass when field omitted

  WebAuthn authenticator attachment policy is not enforced when clients omit the attachment field, allowing use of authenticators outside policy constraints.