RATATOSKRATATOSK
Sign in

Keycloak

26.7.5Security
Sep 30, 2026

ACTION 4CHECK 11OTHER 13

A security-focused maintenance release with CVE fixes across authentication and authorization flows, along with updates to affected dependencies. It also contains correctness and stability fixes, including a new client-role requirement for Identity Provider management in the admin UI.

Action needed (4)

  • securitycriticalCVE-2026-84939 org.freemarker:freemarker dependency

    The org.freemarker:freemarker dependency is updated for CVE-2026-84939.

  • securityhighCVE-2025-66021 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependency

    The com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer dependency is updated for CVE-2025-66021.

  • securityhighCVE-2026-8798 org.bouncycastle:bc-fips dependency

    The org.bouncycastle:bc-fips dependency is updated for CVE-2026-8798.

  • securityhighCVE-2026-13505 org.bouncycastle:bc-fips dependency

    The org.bouncycastle:bc-fips dependency is updated for CVE-2026-13505.

Check if affected (11)

  • securitymediumCVE-2026-16103 and CVE-2026-9798 CIBA lockout bypass fixes

    Applies if you use oidc.

    CVE-2026-16103 fixes an incomplete fix for CVE-2026-9798, which affected CIBA brute-force lockout at token redemption in oidc.

  • securitymediumCVE-2026-18203 group policy path matching

    Applies if you use authorization-services.

    CVE-2026-18203 fixes group policy child-extension matching of sibling group path prefixes in authorization-services.

  • securitymediumCVE-2026-18207 source-group condition enforcement

    Applies if you use oidc.

    CVE-2026-18207 fixes source-group condition matching for duplicate group names, which could skip negative-logic enforcement in oidc.

  • securitymediumCVE-2026-18208 introspection response claims

    Applies if you use oidc.

    CVE-2026-18208 fixes inactive out-of-audience introspection responses that could include a signed JWT claim in oidc.

  • securitymediumCVE-2026-18211 secure-client-uris localhost exception

    Applies if you use oidc.

    CVE-2026-18211 fixes the secure-client-uris localhost exception, which accepted localhost-prefixed attacker domains in oidc.

  • securitymediumCVE-2026-89298 confidential client secret disclosure

    Applies if you use oidc.

    CVE-2026-89298 fixes disclosure of a confidential client secret to the view-clients role through Client Registration GET in oidc.

  • securitymediumCVE-2026-88770 Device Authorization Grant lockout

    Applies if you use oidc.

    CVE-2026-88770 fixes Device Authorization Grant token issuance for brute-force-locked accounts in oidc. The issue is identified as a sibling of CVE-2026-9798.

  • securitymediumCVE-2026-93999 token-exchange refresh for disabled clients

    Applies if you use token-exchange.

    CVE-2026-93999 fixes token-exchange refresh continuing to issue tokens for a disabled audience client in token-exchange.

  • securitylowCVE-2026-18206 client policy wildcard matching

    Applies if you use oidc.

    CVE-2026-18206 fixes client policy source-host wildcard matching so it does not match non-subdomain suffixes in oidc.

  • securitylowCVE-2026-18217 SAML Redirect Binding parameters

    Applies if you use saml.

    CVE-2026-18217 fixes SAML Redirect Binding parameter pollution in saml.

  • breakingClient roles required for Identity Provider management

    Applies if you use admin/ui.

    Managing Identity Providers in the admin/ui now requires client roles in the realm.

All 13 other recorded changesfixes 11 · value changes 2

fixes (11)

  • DCR: Registration access token allows protocol switch from OIDC to SAML <code>oidc</code>
  • Missing input length validation on username field causes outsized log generation in /login-actions/authenticate <code>authentication</code>
  • Upgrade to 26.7.0 crashes under several tested scenarios. LazyInitializationException on non-deterministic getRealmsStream() order after DB dump/restore. <code>infinispan</code>
  • PAR request URI lifespan is used as a hard cap on interactive login duration <code>oidc</code>
  • [quarkus-next] BouncyCastle 1.85 breaks SAML client creation when client ID exceeds 64 characters <code>dist/quarkus</code>
  • New Infinispan node joining the cluster becomes a command target/coordinator before its cache components are ready - ISPN000136 failures during Keycloak rolling restarts <code>infinispan</code>
  • DEBUG logging breaks persistent client session locking <code>storage</code>
  • Identity Provider Mappers - organization group targets do not resolve <code>organizations</code>
  • Event listeners receive the wrong event type when an EventBuilder is reused (e.g. FEDERATED_IDENTITY_LINK is logged and emailed as LOGIN) <code>core</code>
  • Admin Permissions filtering is applied to organization lookups during end-user authentication <code>organizations</code>
  • Format string mismatches in logging statements cause silent argument loss and potential MissingFormatArgumentException <code>core</code>

value changes (2)

  • Upgrade to Quarkus 3.33.4 <code>dist/quarkus</code>
  • Improve retrieval of large read-only resources via admin API <code>storage</code>
Add Keycloak to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Keycloak releases →