RATATOSKRATATOSK
Sign in

Keycloak

26.8.0Security
Oct 1, 2026

ACTION 21CHECK 64PLAN 10OTHER 258

A security-focused release with broad fixes across identity brokering, OIDC, OID4VCI, SCIM, LDAP, session handling, and credential policies. It also changes brute-force detection to persist data in the database by default, adds administration and deployment capabilities, and deprecates several compatibility, clustering, and session features.

Action needed (21)

  • securitymediumCVE-2026-12388 IdP mapper admin-role escalation

    Corrects IdP mapper admin-role escalation tracked as CVE-2026-12388.

  • securitymediumCVE-2026-19608 path-specific group-policy matching

    Corrects name-only group claims that could let same-named groups satisfy path-specific group policies.

  • securitymediumcom.fasterxml.jackson.core:jackson-databind 2.22.0

    Updates com.fasterxml.jackson.core:jackson-databind to version 2.22.0 for CVE-2026-54515 and CVE-2026-59889.

  • securitymediumio.netty:netty-codec-http 4.1.136.Final

    Updates io.netty:netty-codec-http to version 4.1.136.Final for CVE-2026-59903.

  • securityThe secure-client-node-hostname client policy executor

    Adds the secure-client-node-hostname client policy executor to protect against server-side request forgery.

  • securitySMTP masked-credential destination verification

    Corrects SMTP masked-credential substitution that did not verify unchanged destination fields.

  • securitySame-second refresh-token rotation

    Corrects same-second refresh-token rotation that allowed replay of stale tokens.

  • securityCache-miss session rehydration

    Corrects cache misses rehydrating deleted sessions from the database.

  • securityUser partial-filter ancestor-group denies

    Corrects user partial filters ignoring ancestor group-membership denies.

  • securityClient-update admin-event private keys

    Corrects client-update admin events retaining private-key attributes.

  • securityRegistration access tokens in admin events

    Corrects registration access-token regeneration storing live bearer tokens in admin events.

  • securityRP-initiated logout initiating_idp handling

    Corrects RP-initiated logout suppressing upstream broker logout through a forged initiating_idp.

  • securityComponentResource.getSubcomponentConfig class loading

    Restricts unrestricted Class.forName() use on the query parameter in ComponentResource.getSubcomponentConfig.

  • securityRead-only client-type properties during registration

    Prevents bypass of read-only client-type properties during registration.

  • securityAbsence-based completion predicates

    Corrects absence-based completion checks that could not distinguish consumed events from never-persisted events.

  • securityBulk HQL executeUpdate classification

    Corrects bulk HQL executeUpdate bypassing AsyncCommitIntegrator security classification.

  • securityPassword denylist Turkish-locale handling

    Corrects a Turkish-locale bypass of the password denylist.

  • securityToken-exchange delegation-token actor validation

    Corrects token-exchange provider routing that allowed delegation tokens to bypass actor validation through standard exchange.

  • breakingDatabase persistence for brute-force detection data

    Brute-force detection data is persisted in the database by default.

  • breakingPersistent login failures as the default

    Makes persistent login failures the default.

  • breakingIdentityProviderModel.getOrganizationId() removal

    Removes IdentityProviderModel.getOrganizationId().

Check if affected (64)

  • securitymediumCVE-2026-14781 OIDC broker email-verification handling

    Applies if you use the OIDC broker.

    Corrects OIDC broker handling that could mark unverified email addresses as verified through id_token and userinfo processing.

  • securitylowCVE-2026-4633 Organizations identity-first login

    Applies if you use organizations.

    Corrects identity-first login user enumeration when Organizations is enabled, tracked as CVE-2026-4633.

  • securityLDAP bind credentials after connection URL changes

    Applies if you use LDAP.

    Corrects sending LDAP bind credentials to a new server after a connection URL change.

  • securityClient GET endpoint secret exposure

    Applies if you use Client GET endpoints.

    Corrects Client GET endpoints returning raw client secrets to holders of the view-clients role.

  • securityClient private-key database storage and generate endpoints

    Applies if you use generate endpoints.

    Stops storing client private keys in the database and deprecates the generate endpoints.

  • securityClient baseUrl URI-scheme validation

    Applies if you use Client baseUrl.

    Adds URI-scheme validation for Client baseUrl during realm and partial import.

  • securityallowed-protocol-mappers enforcement in the Admin REST API

    Applies if you use allowed-protocol-mappers.

    Enforces the allowed-protocol-mappers client policy executor for Admin REST API protocol-mapper operations.

  • securityOIDC PAR request-URI realm binding

    Applies if you use OIDC.

    Corrects PAR request URIs being stored in a single-use cache without realm binding.

  • securityOID4VCI issued-credential deletion ownership validation

    Applies if you use OID4VCI.

    Adds ownership validation to the Account API delete endpoint for issued verifiable credentials.

  • securityParameterized Scopes username enumeration

    Applies if you configure Parameterized Scopes.

    Corrects pre-authentication username enumeration through Parameterized Scopes username and delegation scope types.

  • securityParameterized Scopes prefix resolution

    Applies if you configure Parameterized Scopes.

    Corrects prefix resolution that allowed a permissive Parameterized Scope to shadow a stricter scope.

  • securityCustomRegexScopeType input length

    Applies if you configure Parameterized Scopes.

    Limits unbounded input passed to the administrator-defined regex in CustomRegexScopeType.

  • securitySCIM Groups member-operation administration checks

    Applies if you use the SCIM Groups endpoint.

    Corrects missing isAdminUser enforcement for SCIM Groups endpoint member operations.

  • securitySCIM PATCH maxOperations enforcement

    Applies if you use SCIM and configure maxOperations.

    Enforces maxOperations for SCIM PATCH operation lists.

  • securityClient API v2 addClient() authorization

    Applies if you use Client API v2.

    Corrects temporary client creation through the addClient() shim bypassing realm-level authorization.

  • securityOID4VCI key_attestations_required enforcement

    Applies if you use OID4VCI and configure key_attestations_required.

    Enforces key_attestations_required when the proof JWT lacks a key-attestation header.

  • securityOID4VCI key-attestation x5c validation

    Applies if you use OID4VCI.

    Corrects validation of key-attestation x5c chains against system CA certificates without EKU or revocation checks.

  • security/create-credential-offer expiration parameter

    Applies if you use /create-credential-offer.

    Constrains the expire parameter on /create-credential-offer to prevent indefinite pre-authorized codes.

  • securityOID4VCI LD-VC remote @context retrieval

    Applies if you use OID4VCI.

    Restricts LD-VC signer retrieval of remote @context URLs over HTTP.

  • securityOID4VCI credential-subject did attributes

    Applies if you use OID4VCI.

    Corrects use of a user-editable did attribute as a credential subject with only realm-local uniqueness.

  • securityCredential-request RSA encryption algorithms

    Applies if you use OID4VCI.

    Corrects credential request decryption accepting RSA1_5 for RSA-OAEP-256 encryption keys.

  • securitySCIM Users filter group-membership disclosure

    Applies if you use SCIM Users filters.

    Corrects SCIM Users filters leaking hidden group membership under FGAP.

  • securitySCIM Groups filter user-membership disclosure

    Applies if you use SCIM Groups filters.

    Corrects SCIM Groups filters leaking hidden user membership under FGAP.

  • securitySCIM mapped-attribute view permissions

    Applies if you use SCIM.

    Corrects SCIM reads and filters bypassing user-profile view permissions for mapped attributes.

  • securitySD-JWT signature-algorithm verification

    Applies if you use SD-JWT.

    Corrects SD-JWT verification accepting a signature algorithm different from the JWS header.

  • securityServer info database-detail exposure

    Applies if you use Server info.

    Corrects Server info exposing database operational details to view-realm administrators.

  • securitySAML inbound LogoutResponse signature verification

    Applies if you use LogoutResponse.

    Adds signature verification for inbound SAML LogoutResponse messages.

  • securityOIDC Dynamic Client Registration PUT scope handling

    Applies if you use OIDC Dynamic Client Registration PUT.

    Corrects an unauthenticated HTTP 500 error on OIDC Dynamic Client Registration PUT requests through the scope field.

  • securityRoot-path redirect security headers

    Applies if you configure http-relative-path.

    Corrects missing security headers on root-path redirects when http-relative-path is configured.

  • securityOID4VCI RSA1_5 credential-request handling

    Applies if you use OID4VCI.

    Corrects an unauthenticated RSA1_5 padding oracle in OID4VCI credential requests.

  • securityOID4VC issued-credential deletion scope

    Applies if you use OID4VC.

    Scopes OID4VC issued-credential deletion to the path user and realm.

  • securityConcurrent WebAuthn registration completion

    Applies if you use WebAuthn.

    Corrects concurrent WebAuthn registration completion persisting multiple passwordless credentials.

  • securityLDAP password-policy response-control parsing

    Applies if you use LDAP.

    Corrects LDAP password-policy response-control parsing, including warning and error tag collisions and uncaught NumberFormatException login failures.

  • securitySCIM membership PATCH audit events

    Applies if you use SCIM.

    Corrects SCIM membership PATCH audit events omitting the changed relationship.

  • securitySCIM legacy query-role memberships

    Applies if you use SCIM and do not enable FGAP.

    Corrects SCIM legacy query roles inferring cross-resource memberships when FGAP is disabled.

  • securitySCIM Group DELETE administrative-resource protection

    Applies if you use SCIM Group DELETE.

    Corrects SCIM Group DELETE bypassing administrative-resource protection through cascades.

  • securitySCIM user-deletion security-state cleanup

    Applies if you use SCIM.

    Corrects SCIM user deletion skipping security-state cleanup.

  • securityBrute-force reset-boundary failure counters

    Applies if you use brute-force detection.

    Corrects concurrent failures at the brute-force reset boundary erasing newly recorded attempts.

  • securityLoginFailureEntity async-commit classification

    Applies if you use LoginFailureEntity.

    Corrects LoginFailureEntity async-commit classification discarding failure counters after failover.

  • securityMulti-Cluster v2 ephemeral-data commits

    Applies if you enable Multi-Cluster v2.

    Corrects Multi-Cluster v2's no-data-loss RPO conflicting with default asynchronous commits of ephemeral data.

  • securityCredential-offer client-role namespace handling

    Applies if you use credential offers.

    Corrects same-named client roles authorizing credential offers for unintended targets.

  • securityOID4VCI rotated refresh-token reuse

    Applies if you use OID4VCI.

    Corrects reuse of a rotated OID4VCI refresh token repeatedly reissuing credential authority.

  • securitySD-JWT credential lifetime attributes

    Applies if you use SD-JWT.

    Corrects user-editable mapped attributes extending SD-JWT credentials beyond the issuer-configured lifetime.

  • securityOID4VCI approved attribute snapshots

    Applies if you use OID4VCI.

    Corrects credential issuance ignoring the administrator-approved attribute snapshot.

  • securityOID4VCI credential-request authentication order

    Applies if you use OID4VCI.

    Corrects unauthenticated credential requests triggering private-key JWE decryption before bearer authentication.

  • securityOID4VCI targeted-offer refresh handling

    Applies if you use OID4VCI.

    Corrects refreshed stolen targeted offers bypassing offer-required issuance for another user.

  • securityOID4VCI SD-JWT array-claim disclosure

    Applies if you use OID4VCI.

    Corrects OID4VCI SD-JWT issuance that made array claims all-or-nothing disclosures.

  • securitykcadm existing configuration-file permissions

    Applies if you use kcadm.

    Corrects kcadm preserving world-readable permissions on existing configuration files.

  • securitySCIM search filter values in debug logs

    Applies if you use SCIM.

    Corrects SCIM search writing raw filter values to debug logs.

  • securityRecovered-site security configuration

    Applies if you use sites.

    Corrects recovered sites enforcing stale security configuration for up to one hour.

  • securityOID4VCI access-token endpoint scope

    Applies if you use OID4VCI.

    Restricts OID4VCI access tokens to the credential endpoint.

  • securityOID4VCI decompression limits

    Applies if you use OID4VCI.

    Corrects an OID4VCI memory leak and adds a decompression limit.

  • securityOrganization-IdP link policies during realm import

    Applies if you use organizations.

    Corrects realm import resetting the organization-IdP link policy to permissive defaults.

  • securityOrganization-link access in identity-provider reads

    Applies if you use organizations.

    Corrects identity-provider reads disclosing organization links outside the caller's scope.

  • securityClient-scoped endpoint view restrictions

    Applies if you use client-scoped endpoints.

    Corrects view-clients bypassing view-users restrictions through client-scoped endpoints.

  • securityAdmin v2 API PATCH secret-rotation policy

    Applies if you use the Admin v2 API.

    Corrects Admin v2 API PATCH bypassing the client secret-rotation policy.

  • securityOIDC logout client_id log sanitization

    Applies if you use the OIDC logout endpoint.

    Corrects log injection through an unsanitized client_id in the OIDC logout endpoint.

  • securitySCIM resource-ID phishing

    Applies if you use SCIM.

    Corrects SCIM resource-ID phishing.

  • securityAdmin API v2 client-secret exposure

    Applies if you use admin/api.

    Corrects Admin API v2 returning plaintext client secrets to holders of the view-clients role.

  • breakingSCIM username updates with Edit username disabled

    Applies if you use SCIM.

    Prevents SCIM API username updates when the Edit username setting is disabled.

  • securitySingle-valued organization mapper membership

    Applies if you use identity brokering.

    Corrects a single-valued organization mapper emitting an attacker-selected non-member organization.

  • securityOrganization group-representation role metadata

    Applies if you use organizations.

    Corrects organization group representations leaking client and realm role metadata to unauthorized administrators.

  • breakingKeycloak Realm Operator end of life

    Applies if you use the Keycloak Realm Operator.

    Ends support for the Keycloak Realm Operator.

  • breakingDevice-flow client scope validation

    Applies if you use OIDC.

    Makes device flow reject a scope parameter containing a scope not permitted for the client.

Plan ahead (10)

  • deprecatedMulti-cluster v1 (multi-site) deprecationremoval date not announced

    Applies if you enable multi-site.

    Deprecates Multi-cluster v1, the multi-site feature.

  • deprecatedThe login-failures:v1 behavior, deprecated

    Applies if you enable login-failures:v1.

    The former in-memory behavior remains available as login-failures:v1, but is deprecated.

  • deprecatedKerberos Credential delegation deprecation

    Applies if you use Kerberos.

    Deprecates Kerberos Credential delegation.

  • deprecatedLegacy OIDC client-switch deprecation

    Applies if you configure OpenID Connect Compatibility Modes.

    Deprecates legacy OIDC client switches from OpenID Connect Compatibility Modes.

  • deprecatedVolatile-session deprecation

    Applies if you configure volatile sessions.

    Deprecates volatile sessions and adds an option to opt out of session caching.

  • deprecatedFull scope allowed client-switch deprecation

    Applies if you configure Full scope allowed.

    Deprecates the Full scope allowed client switch.

  • deprecatedNon-OIDC client-registration provider deprecation

    Applies if you use client registration providers.

    Deprecates client registration providers other than OIDC.

  • deprecatedAUTH_SESSION_ID sticky-session routing deprecation

    Applies if you configure the AUTH_SESSION_ID cookie.

    Deprecates routing sticky sessions from the AUTH_SESSION_ID cookie.

  • deprecatedClusterless feature deprecation

    Applies if you enable clusterless.

    Deprecates the clusterless feature.

  • deprecatedIn-memory login-failure deprecation

    Applies if you enable in-memory login failures.

    Deprecates in-memory login failures.

All 258 other recorded changessecurity fixes 1 · fixes 157 · value changes 50 · additions 37 · constraints 9 · defaults 3 · renames 1

security fixes (1)

  • [OID4VCI] c_nonce Replay

fixes (157)

  • SAML ECP endpoint returns inconsistent Content-Type on error responses
  • UserInfo Endpoint: Add null-check for SignatureProvider when validating JWT bearer tokens
  • UserInfo Endpoint: Handle malformed Content-Type header gracefully
  • OIDC: Inverted return value in compareSessionIdWithSessionCookie() backwards-compatibility path
  • OID4VCI: getAttestationRequirements() hardcodes proof-type key to jwt ignoring other types
  • Identity Broker v2: Wrong-IdP token returned after account-linking due to un-namespaced session note
  • Handling HTTP/2 connection coalescing issues originating from wildcard certificates
  • OID4VC JWT proof JWK claim type confusion crashes proof validation
  • URI client-policy executors omit OIDC front-channel logout URI
  • Workflow group membership events confuse slash-named groups with nested paths
  • Workflow role grant events match client and realm roles by bare name
  • JOSE: Base64Url decoder throws unchecked exception on padding-only input
  • Admin API v2 client update does not clean up stale rotated secret attributes
  • SAML metadata key cache is not invalidated on client updates
  • Selecting value in combobox not default listed
  • PassKey "User verification requirement" error's are not translated
  • refresh_expires_in is 0 for offline tokens when Offline Session Max Limited is disabled, but server enforces Offline Session Idle
  • Ensure consistent transaction rollback across all error response paths
  • Missing index on WORKFLOW_STATE.SCHEDULED_STEP_TIMESTAMP causes full filter scan in getDueScheduledSteps
  • Organization group-by-path endpoint returns a brief representation instead of a full representation
  • Ensure consistent transaction rollback in SCIM error response paths
  • Keycloak with jdbc-ping stack failed to create a cluster after the MariaDB restore procedure
  • Client configuration changes are not propagated between sites
  • Organization authenticator drops the typed username when falling through to the default identity-provider-redirector (no login_hint)
  • SAML broker: IdP-initiated logout fails with HTTP 500 and is rolled back when the IdP has no single logout service URL
  • Flow steps back when changing locale or refreshing page (Regression of #30520 / #30644)
  • After update from 26.0 to 26.1 extent account theme keycloak.v3 is not working for custom components
  • User creation problem with default groups defined, with identity provider and federated openldap
  • ConcurrentModificationException in parallel Quarkus build steps
  • [OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption
  • NullPointerException in ResourceIndicatorsPostProcessor when access token audience is null
  • SSF: Client scopes ssf.read and ssf.manage not created when SSF enabled for existing realm
  • Creating a new realm from json using kcadm gives a PK violation on KEYCLOAK_ROLE despite it only being defined once in the JSON.
  • [OID4VCI] CNF is not included in sd-jwt when number_of_decoys is not explicitly configured
  • Malformed Content-Type header causes HTTP 500 on token endpoints instead of RFC 6749 §5.2 compliant 400
  • Keycloak doesn't honor --https-trust-store-type when automatically creating the Trust Store
  • Scope-based permission accepts a scope not associated with the selected resource (Admin REST API)
  • Admin Console: saving attributes fails when the attribute key is "constructor", "toString", or another Object.prototype name
  • LifeSciences Login does not work anymore in Keycloak version 26.6.3
  • SearchQuery.getFields() exceptions
  • [CIMD] Claude Desktop authentication rejected by Keycloak: jwt-bearer grant type incompatible with public client
  • Admin UI: Resource search does not work in Authorization Evaluate “Resources and Scopes - Key” selector
  • ConcurrentModificationException in OrganizationAdapter.setAttributes on concurrent PUT /organizations/{id}
  • User federation synchronizations will always evict all users of a realm from the users cache
  • REVOKE_GRANT_ERROR prevents logout except when account console is open in another tab
  • SAML broker artifact binding fails to validate signed nested Response inside ArtifactResponse: Cannot resolve element with ID
  • UI shows inherited role as non-inherited when the same role is also assigned manually
  • Email not lowercased in "Always Read Value From LDAP" delegate (incomplete fix from #43254)
  • Exporting a realm with users says it needs file parameter, which is provided
  • Trusted SSF event emission persists verbatim event payload in admin events
  • Putting --optimized before command gives confusing error message
  • NPE thrown on null secret in AbstractOauth2IdentityProdivder
  • ClientManager.isInternalClient checks only for "master" realm
  • SCIM: query-users role returns empty Resources array despite correct totalResults
  • Dynamic client registration: "scope" member in the request suppresses realm default client scopes on the created client
  • Synthetic SSF emit accepts mismatched user and tenant subjects when only the tenant is subscribed
  • Keycloak does not apply connect timeout when Oracle runs in XA mode
  • NPE in executor configuration validation
  • Empty or null description causes duplicate "Allowed field:"
  • [kcw] kcw dev greps incorrect Keycloak version
  • Recovery codes have numeric input field despite alphanumeric codes being generated
  • Usage of second class configuration may not be masked in show-config
  • Logout fails when IdP is disabled
  • PreparedStatement can have at most 65,535 parameters
  • Token exchange and JWT grants ignore use-lightweight-access-token policy
  • Test Authentication fails after correcting LDAP connection URL until configuration is saved
  • SCIM filter parentPath not saved/restored in visitValuePath, breaks nested valuePath
  • SCIM PATCH does not enforce attribute mutability
  • SCIM PATCH NPE when request body contains "schemas": null
  • [OID4VCI] Handling of realm optional client scopes
  • Admin API v2: SAML string-attribute mapper does not remove attributes on explicit null or omission
  • Do not pass the client for Delegation parameterized scope type
  • LDAP Enabled switch remains interactive for users with view-realm only
  • Account already existed page button has no gap and no hover on effect
  • [OID4VCI] Incorrect metadata for key_attestations_required
  • Better server error message and handling if email sender is disabled in configuration
  • InvalidPathException when running test cases in embedded mode on Windows
  • Admin Console: changing the search term while on a later page keeps the old page offset and shows no results
  • truststore-paths certificates are ignored by FileTruststoreProviderFactory
  • Pin resolved identity to prevent consent transfer on user recreation
  • SCIM filter predicates handle case-insensitive matching incorrectly
  • Workflow add-required-action does not allow all available required actions
  • [UX] account console nav on mobile not closing after selecting a page
  • Enabling parameterized-scopes breaks the built-in organization:<alias> scope
  • Deleting a user attribute deletes all custom message localizations of default language en
  • Admin console Realm Settings delete uses display name instead of realm name (regression from #48084)
  • SCIM filtered PATCH remove deletes all values for multivalued extension attributes
  • Composite realm role mappings endpoint does not scale with the number of realm roles
  • TypeError crash in Evaluation tab when selecting "Group" resource type
  • SPNEGO mutual authentication response token is not returned after successful login
  • SSF: Missing event details during user logout trigger NPE
  • SCIM: organization groups exposed via the groups attribute on Users
  • SCIM Users groups filter does not exclude organization groups
  • Migrate remaining login pages have no override in the keycloak.v2 theme
  • Keycloak's password length policy isn't triggered when changing password in FIPS mode
  • Exceptions in Kubernetes federated-client-authentication signature verification are silently swallowed with no default-level log trace
  • [OID4VCI] Labels for OID4VCI events missing in the admin console
  • [OID4VCI] Some error events not reported
  • Base implementation of AbstractModelSchema.getAttributeMappers is keyed by model attribute name
  • Dutch translation for linkExpirationFormatter produces duplicated value ("12 12 uur")
  • Scim complex type attributes are forced to be case-insenitive
  • EXECUTE_ACTION_TOKEN : event impossible to save
  • [OID4VCI] mdoc not properly configurable in admin console client scope tab
  • Regression: resource_access claim becomes empty {} when populated via User Attribute mapper with JSON value (since 26.7.1)
  • Organization invitation fails with invalid_redirect_uri when the organization has no Redirect URL configured
  • Client-side password policy validation does not treat underscore _ as a special character
  • Securing Client Cluster Node Registration via Client Policy Executor
  • Organization invitation is lost when the invitee signs up with a realm-level identity provider
  • Fix missing arguments in HardcodedLDAPRoleStorageMapper warning log
  • Fine-Grained Admin Permissions v2: Cannot view a user who belongs to a group without "view" permission on that group
  • [OID4VCI] Cannot unset values when configuring OID4VCI credential scope
  • User Profile settings allow mapping multiple attributes to the same SCIM attribute
  • User creation via SCIM API does not enforce User Profile "required" validation for core user schema attributes
  • Duplicate English text in generateKeysDescription message key
  • SCIM API does not enforce User Profile validators
  • Missing detailed audit information in group / relam role operatons
  • Workflows: notify-user email template hardcodes English text, so notifications cannot be fully translated
  • Admin REST OpenAPI schema types groups-in-role responses as UserRepresentation
  • Organization missing from the login form model on the invitation confirm-membership page
  • [OID4VCI] Server-side validations for "Supported proof types" and "Cryptographic binding methods"
  • DPoPBindEnforcerExecutor requires DPoP on client create/update, defeating its own refresh-token-only binding option
  • Admin console crashes with a raw TypeError when a group request returns 404
  • Integer overflow in OIDC re-auth max_age comparison (OIDCLoginProtocol)
  • ResourceIndicatorsPostProcessor error does not log appropriate error event
  • Regression in 26.7.0: DefaultClientSessionContext.getScopeString() no longer attaches "openid" scope on token refresh when the client omits it from the request
  • ClosingStream does not close underlying stream when terminal operation throws an exception
  • HHH90010101 warning logged during SCIM concurrent requests due to orphaned Hibernate before-completion callbacks
  • HHH100503 INFO message logged during concurrent SCIM requests after constraint violation
  • Organization group: removeMember should fail when user is not a member
  • Stateless JPA providers: race condition between INSERT ON CONFLICT DO NOTHING and concurrent DELETE
  • Cluster event poller: uncaught ClassCastException on malformed event data
  • JpaRevokedTokenProvider uses deprecated Time.currentTime() (int) instead of Time.currentTimeSeconds() (long)
  • First cluster-readiness probe returns UP before asynchronous CP check completes
  • Unable to re login after deleting the Identity Provider configurations
  • SCIM Group PUT overwrites externalId despite schema declaring it immutable
  • NO_PROXY entries with leading dots or spaces after commas silently fail
  • JWT Authorization Grant cannot be configured with Organization-linked IdPs
  • Consent screen returns HTTP 500 for a user in more than one organization (regression in 26.7.0)
  • Admin Console: Client scopes Evaluate tab does not refresh generated tokens when the user changes
  • NullPointerException when POSTing null payload to /admin/realms/{realm}/groups
  • Disabled organization set on session context during broker login callback
  • [quick-theme] Login Page Preview stylesheet URL omits the http-relative-path prefix
  • #46367 regression in user provider sync behavior
  • Admin UI: IdP organization login switches always persisted as false
  • Client roles are not displayed in "Effective role scope mappings" in Client Scope Evaluate
  • GrantTypeCondition misses some event types
  • Organizations: malformed domain in login username (e.g. user@example;com) causes unhandled ModelValidationException ('Invalid domain format')
  • WARN [io.quarkus.deployment.index.IndexWrapper] (build-44) Failed to index void: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@66ce957f
  • SSF discovery document (.well-known/ssf-configuration) omits /realms/{realm} path when realm frontendUrl is set
  • signingCertificate handling in v2
  • MayAct executor rejects valid delegation when the scope parameter is not the exact stored username
  • Skips the ClientID binding checks when the claim is not a string
  • prompt=none returns login_required for organization members without local credentials when the broker has "Redirect when email domain matches"
  • Upgrade migration can attach a stale IdP route to another organization's domain
  • Missing manage-organizations permission check for org group mappers
  • Admin Console user picker (UserSelect) sends username= contains search, producing leading-wildcard LDAP filters that time out on large directories
  • SCIM user PUT/PATCH bypass the user cache: active=false via SCIM does not disable the user for logins

value changes (50)

  • the admin event store no longer receives unvalidated payloads to prevent PII leakage
  • Parameterized scopes have officially moved from experimental to preview status.
  • Token exchange delegation support status is now preview.
  • Token lifecycle events (<code>CODE_TO_TOKEN</code>, <code>REFRESH_TOKEN</code>, and others) are now enriched with <code>impersonator</code> and <code>impersonator_id</code> details
  • The Client Admin API v2, introduced as an experimental feature in Keycloak 26.7, has been promoted to preview.
  • In this release, Client Secret Rotation is promoted from preview to supported.
  • In this release, the SCIM API is promoted from preview to supported.
  • In this release, multi-cluster v2 and the <code>stateless</code> feature are promoted from preview to supported.
  • The social identity provider section on the login page has been refreshed with updated icons, a new divider layout, and improved button labels.
  • Improve WebAuthn error messages
  • SAML Responses with Invalid Signatures
  • Upgrade FreeMarker to the most recent version
  • Better memory management with argon2
  • Upgrade to Quarkus 3.40 LTS
  • Refactor SSF to use keycloak-admin-client and react hook form
  • Switch internal HTTP client from Apache to Vert.x/Netty
  • Make UuidUnmodified more generic so that we can use it on multiple fields
  • Sorting Applications in Account Console
  • Redesign identity provider buttons on the login page
  • Improve runtime when building user representations via User Profile
  • Upgrade to Quarkus …×5
  • SCIM user serialization creates ~200x more UserProfile instances than necessary
  • SCIM search/list executes unconditional COUNT(*) query on every request
  • SCIM filter string is parsed twice through ANTLR4 grammar per request
  • Unify QR code and divider components in the login theme
  • [OID4VP] Improve cross-device login page layout
  • Unify OTP setup buttons to use shared buttons macro
  • Skip unnecessary provider initialization for non-server commands
  • Authentication events should distinguish primary vs rotated client secret
  • Improve help text for admin permissions (FGAP) fields
  • Distinguish between Login Theme and Account Console for an already existing Mail in Keycloak
  • SCIM filtered search should leverage the Infinispan entity cache
  • Store provider.jar mtime in seconds in keycloak-persisted.properties for Quarkus re-augmentation
  • Retarget quarkus-next to Quarkus 3.39 branch after 3.x branch was dropped
  • Avoid contention on IDX_USER_SESSION_EXPIRATION_* indexes on MS SQL/MySQL
  • Optimize index sizes for session storage in the database
  • Avoid updates to IDX_USER_SESSION_EXPIRATION_LAST_REFRESH on every token refresh
  • Upgrade to Quarkus ….CR1×2
  • Extend asynchronous commit optimization to SQL Server and Oracle
  • Upgrade to Infinispan 16.0.15
  • Cache parsed theme resource declarations to avoid re-parsing them on every login page render
  • Cache the resolved max-length configuration for OIDC request parameters
  • Avoid building the WebAuthn trust verifier on every login
  • <p>The <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html">OpenID for Verifiable Credential Issuance (OID4VCI)</a> feature has been promoted from experimental to preview.
  • hardened x5c certificate validation following the HAIP profile.

additions (37)

  • Keycloak can now act as an OID4VP verifier
  • now emits RISC <code>account-disabled</code> and <code>account-enabled</code> event types
  • Users can now delegate access to a client application through OAuth consent using the new <code>delegation:client:&lt;client-id&gt;</code> parameterized scope.
  • A new client policy executor allows administrators to restrict the <code>may_act</code> claim in access tokens
  • The new <code>invite-user</code> workflow step sends an action-token email automatically when a user is created
  • Client Policies now provide the <code>allowed-protocol-mappers</code> executor
  • Multi-cluster v2 enables connecting two or more Keycloak clusters without an external Infinispan cluster
  • Keycloak now supports encrypted PKCS#8 private keys in PEM format for HTTPS configuration.
  • configured with the new <code>--cache-embedded-cluster-name</code> and <code>--cache-embedded-node-name</code> CLI options
  • Keycloak now automatically creates skipped indexes in the background after startup
  • Keycloak now provides an experimental Vert.x-based HTTP client
  • Keycloak now releases an experimental Helm chart to install the Operator.
  • Identity providers can now be linked to multiple organizations
  • Document trust boundaries for attribute-based conditions with self-registration enabled
  • Add warning about dynamic urls to reflect the danger of hostname pollution
  • Supported client secret rotation
  • SSF: Add support for RiscAccountPurged event
  • [OID4VP] Support direct_post.jwt (encrypted) response mode
  • Accept encrypted PEM TLS certificate key
  • Parametrized client_id in the organization invite link and invite token
  • Concurrent Index creation on PostgreSQL and other databases for DB migrations
  • Account Console: Add per-application session termination on the Applications page
  • Signed JWT - Federated: support managed Kubernetes (EKS, GKE, AKS) via dynamic OIDC issuer discovery
  • Add invite-user workflow step
  • Add default non-endpoint methods to the admin api v2 interfaces as needed for typing
  • [OID4VCI] Implement missing HAIP conformance tests
  • Token Exchange Delegation for Clients
  • Complete Identity Provider support in the Test Framework Realm DSL
  • [CIMD] Resource Indicators with CIMD
  • Introduce dedicated delegation permission for token exchange delegation
  • Add actor to impersonation tokens and details to event logs
  • Add session bucket and coarse-grained timestamp to ROOT_AUTH_SESSION for reduced index contention
  • Refresh Token Introspection
  • Credential lifecycle management now includes revocation when refresh tokens are revoked
  • a new Application Initiated Action (AIA) lets users request credential issuance within an authenticated session.
  • Key attestation is configurable in the admin console
  • This release also adds experimental support for the mdoc format, provided by the new experimental feature <code>oid4vc-mdoc</code>.

constraints (9)

  • The SCIM API received extensive improvements including support for multivalued user attributes
  • SCIM: Missing lower-bound validation on count parameter in list operations
  • Infinispan: LoginFailures cache should not be unbounded
  • Infinispan metrics should not contain a dynamic node label
  • KeyCloak Admin Client - Support Jackson 3
  • Make the Roles field optional on the client Authorization Evaluate tab
  • [SAST] Restrict direct access to issuedFor variable
  • SCIM should also return a forbidden response status for schemas and resourceTypes if the query is present in the request
  • Unable to select authorization scopes beyond the first 100 in Scope-Based Permissions

defaults (3)

  • The <code>delegation:user</code> and <code>delegation:client</code> client scopes are now auto-created as Optional scopes in all realms
  • When deploying with the Keycloak Operator, the node name is now automatically set to the Kubernetes pod name
  • New identity provider links created after upgrading default to the Unmanaged membership type.

renames (1)

  • Parameterized scopes (formerly known as dynamic scopes)
Add Keycloak to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Keycloak releases →