RATATOSKRATATOSK
Sign in

Keycloak

26.8.1Security
Oct 13, 2026

ACTION 7CHECK 21OTHER 19

A security-focused maintenance release with vulnerability fixes across authentication, administration, identity brokering, authorization, token exchange, and observability. It also updates vulnerable `jackson-databind` and `simple-git` dependencies and includes further corrections in clustering, organizations, token handling, and HTTP processing.

Action needed (7)

  • securityhighCVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependency

    The com.fasterxml.jackson.core:jackson-databind dependency was updated for CVE-2026-91777.

  • securitymediumCVE-2026-94001 admin credential deletion authorization

    This release fixes CVE-2026-94001, which allowed an admin credential deletion to bypass denied reset-password permission in admin fine-grained permissions.

  • securitymediumCVE-2026-94215 cross-realm resource access

    This release fixes CVE-2026-94215, which enabled cross-realm realm resource read and write through the per-request session-level cache in RealmCacheSession.

  • securitymediumCVE-2026-97177 user-update authorization

    This release fixes CVE-2026-97177, which allowed a generic user update to bypass denied reset-password permission.

  • securitytools.jackson.core:jackson-databind dependency updates

    The tools.jackson.core:jackson-databind dependency was updated for multiple CVEs.

  • securitysimple-git dependency updates

    The simple-git dependency was updated for multiple CVEs.

  • securityUsername enumeration through empty-password timing

    This release fixes username enumeration through empty-password timing in authentication.

Check if affected (21)

  • securitymediumCVE-2026-15943 identity provider client-secret reuse

    Applies if you use OIDC identity provider and configure token URL.

    This release fixes CVE-2026-15943, which caused an OIDC identity provider update to reuse a masked client secret after token URL changes in identity brokering.

  • securitymediumCVE-2026-82968 identity-provider account linking

    Applies if you use null or GitHub identity provider.

    This release fixes CVE-2026-82968, which allowed persistent wrong-account linking through the null or GitHub identity provider.

  • securitymediumCVE-2026-94000 delegated-admin role escalation

    Applicability is not stated in the release notes.

    This release fixes CVE-2026-94000, which allowed a delegated admin with only manage-users to become realm-admin through group membership or group creation mapped to an admin role.

  • securitymediumCVE-2026-94213 policy evaluation authorization

    Applies if you use the Authorization Services policy evaluation endpoint.

    This release fixes CVE-2026-94213, which involved missing user-view authorization in the Authorization Services policy evaluation endpoint and an incomplete fix for CVE-2026-37978.

  • securitymediumCVE-2026-96446 PAR single-use enforcement

    Applies if you use PAR.

    This release fixes CVE-2026-96446, which allowed a PAR single-use bypass through prompt=none.

  • securitymediumCVE-2026-96445 conditional OTP proxy handling

    Applicability is not stated in the release notes.

    This release fixes CVE-2026-96445, which allowed conditional OTP to trust skip headers on untrusted proxy paths.

  • securitymediumCVE-2026-95503 Kerberos password authentication

    Applies if you configure Kerberos password authentication.

    This release fixes CVE-2026-95503, which enabled a potential KDC spoofing attack when Kerberos password authentication was enabled.

  • securitymediumCVE-2026-97311 Admin REST API group visibility

    Applies if you use the Admin REST API.

    This release fixes CVE-2026-97311, which allowed the roles/{role-name}/groups endpoint in the Admin REST API to disclose groups the caller could not view. The change addresses an incomplete fix from the 26.7.2 hardening.

  • securitymediumCVE-2026-97846 Standard Token Exchange certificate binding

    Applies if you use Standard Token Exchange and configure mTLS certificate binding.

    This release fixes CVE-2026-97846, which allowed Standard Token Exchange to bypass required mTLS certificate binding and issue an active bearer token when no client certificate was supplied.

  • securitymediumCVE-2026-103884 X.509 CRL path traversal

    Applies if you use X.509 CRL Distribution Point.

    This release fixes CVE-2026-103884, which allowed a client-supplied CRL path from an X.509 CRL Distribution Point to escape $KC_HOME/conf.

  • securitymediumCVE-2026-107121 SMTP STARTTLS handling

    Applies if you configure SMTP starttls.

    This release fixes CVE-2026-107121, which allowed SMTP starttls=true to permit plaintext credential and message downgrade.

  • securitymediumFGAP v2 custom role injection, CVE-2026-4629

    Applies if you use FGAP v2 and oidc-hardcoded-role-mapper.

    This release fixes FGAP v2 custom role injection through oidc-hardcoded-role-mapper, which bypassed removeTransientAdminRoles. The change addresses an incomplete fix for CVE-2026-4629.

  • securitylowCVE-2026-18569 OIDC broker logout-token validation

    Applies if you do not configure signature validation.

    This release fixes CVE-2026-18569 in OIDC broker backchannel logout, which accepted unsigned forged logout tokens when signature validation was disabled.

  • securitylowCVE-2026-94218 2FA setup enforcement

    Applies if you use /realms/{realm}/login-actions/restart.

    This release fixes CVE-2026-94218, which allowed 2FA setup enforcement to be bypassed through the /realms/{realm}/login-actions/restart endpoint.

  • securitylowCVE-2026-94217 UMA scope isolation

    Applies if you use UMA.

    This release fixes CVE-2026-94217, which allowed UMA scopes to merge across resource owners through a name collision in resolveResourcePermission.

  • securitylowCVE-2026-101333 broker-login metric series

    Applies if you use the broker login endpoint.

    This release fixes CVE-2026-101333, which allowed unbounded metric series creation through the idp tag on the broker login endpoint.

  • securityKerberos TRACE logging credential exposure

    Applies if you use Kerberos and configure TRACE logging.

    This release fixes Kerberos TRACE logging that recorded complete SPNEGO credentials.

  • securityDynamic client registration SSF event access

    Applies if you use Dynamic client registration.

    This release fixes dynamic client registration self-enabling privileged SSF event access.

  • securitySAML SLO session termination

    Applies if you use SAML SLO.

    This release fixes SAML SLO handling that allowed unauthenticated arbitrary session termination through a LogoutRequest with SessionIndex.

  • securitySAML broker HTTP-Redirect signature verification, ANT-2026-HQ54RPF9

    Applies if you use SAML broker HTTP-Redirect binding.

    This release fixes SAML broker HTTP-Redirect binding signature verification when a semicolon parameter separator caused verification over a different SAMLResponse than the one processed. The change addresses unauthenticated login as an arbitrary user, tracked as ANT-2026-HQ54RPF9.

  • securityFGAP v2 LDAP user search results

    Applies if you use FGAP v2 and LDAP.

    This release fixes FGAP v2 search results that returned non-imported LDAP users to query-users-only delegated admins.

All 19 other recorded changesfixes 19

fixes (19)

  • DockerEndpoint does not validate invalidRequestMessage after parsing authorization request
  • Organizations: Invitation link can be used by multiple users due to missing single-use check
  • refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation
  • Ensure max consumed respone size is respected for OCSP and CRLs
  • SimpleHttpResponse connection pool leak in identity brokering flows
  • Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener)
  • SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check
  • Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down
  • Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows
  • HttpServerUtil.sendResponse drops the headers it is given
  • Organization invite: link in the plain-text part of the email is HTML-escaped and unusable
  • Authenticator Reference is incorrectly masked after CVE-2026-16104 fix
  • Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user
  • Token introspection omits act claim for token-exchange delegation tokens
  • Realm settings - security defenses
  • RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected
  • Regression with Trust Email when the userinfo endpoint is used
  • JGroups certificate reload blocks the view handling thread and hides task failures
  • JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled
Add Keycloak to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Keycloak releases →