RATATOSKRATATOSK
Sign in

Keycloak

26.8.2Security
Nov 5, 2026

ACTION 8CHECK 27OTHER 18

A security-heavy maintenance release with fixes for authentication, authorization, denial-of-service, data-integrity, and other security issues. It also contains dependency updates and ordinary bug fixes, so the security fixes are the main concern for affected Keycloak deployments.

Action needed (8)

  • securitycriticalCVE-2026-111497 bundled Brotli decoder bounds handling

    CVE-2026-111497 fixes an out-of-bounds write in the bundled Brotli decoder in Keycloak 26.8.2.

  • securityhighCVE-2026-97847 sessionless token principal replacement

    CVE-2026-97847 fixes replacement of a sessionless token principal by a client manager in Keycloak 26.8.2.

  • securityhighCVE-2026-103112 authentication race

    CVE-2026-103112 fixes an account takeover caused by an authentication race in Keycloak 26.8.2.

  • securitymediumCVE-2026-92358 cross-browser fallback proof handling

    CVE-2026-92358 fixes the cross-browser fallback proof behavior after successful account linking and self-service unlink in Keycloak 26.8.2.

  • securitymediumCVE-2026-107889 login-page stored XSS

    CVE-2026-107889 fixes a stored cross-site scripting issue on the login page involving a kcSanitize bypass in Keycloak 26.8.2.

  • securityCVE-2026-107124 session takeover through id_token_hint

    CVE-2026-107124 fixes session takeover through victim logout with an injected id_token_hint in Keycloak 26.8.2.

  • securityCVE-2026-96457 group-admin top-level move authorization

    CVE-2026-96457 fixes a group-admin DENY bypass through a top-level move in Keycloak 26.8.2.

  • securityCVE-2026-109081 realm default-roles injection

    CVE-2026-109081 fixes role injection into the realm default-roles by a principal with only create-client permission in Keycloak 26.8.2.

Check if affected (27)

  • securitycriticalCVE-2026-117691 SAML redirect binding signatures

    Applies if you use SAML redirect binding.

    CVE-2026-117691 fixes a SAML redirect binding signature bypass involving a percent-encoded parameter name in Keycloak 26.8.2.

  • securityhighCVE-2026-112208 Organization identity-first login

    Applies if you use Organization identity-first login.

    CVE-2026-112208 fixes account takeover through a stale SSO_AUTH note during Organization identity-first login in Keycloak 26.8.2.

  • securityhighCVE-2026-110932 theme gzip cache disk exhaustion

    Applies if you depend on Keycloak <= 26.8.0.

    CVE-2026-110932 fixes unauthenticated persistent disk exhaustion caused by the theme gzip cache in Keycloak 26.8.2.

  • securityhighCVE-2026-107123 Keycloak SAML endpoint

    Applies if you expose a SAML endpoint.

    CVE-2026-107123 fixes an unauthenticated denial-of-service issue in the Keycloak SAML endpoint in Keycloak 26.8.2.

  • securityhighCVE-2026-107602 SAML 1.1 KeyInfo parser loop

    Applies if you use SAML 1.1.

    CVE-2026-107602 fixes the SAML 1.1 KeyInfo parser loop that could exhaust CPU and the worker pool in Keycloak 26.8.2.

  • securityhighCVE-2026-110931 SAML 1.1 AuthorityBinding parser loop

    Applies if you use SAML 1.1.

    CVE-2026-110931 fixes the SAML 1.1 AuthorityBinding parser loop that could terminate the JVM with an OutOfMemoryError in Keycloak 26.8.2.

  • securityhighCVE-2026-114232 UMA resourceType validation

    Applies if you use UMA.

    CVE-2026-114232 fixes validation of the resourceType field in UMA user-managed permissions in Keycloak 26.8.2.

  • securityhighCVE-2026-93998 SAML adapter issuer validation

    Applies if you use SAML adapter.

    CVE-2026-93998 fixes SAML adapter acceptance of assertions from the wrong configured issuer in Keycloak 26.8.2.

  • securityhighCVE-2026-96453 kcadm custom truststores

    Applies if you use kcadm.

    CVE-2026-96453 fixes kcadm custom truststores accepting arbitrary self-signed certificates in Keycloak 26.8.2.

  • securityhighCVE-2026-92857 DCR reserved claim handling

    Applies if you use DCR.

    CVE-2026-92857 fixes a default-allowed DCR protocol mapper that could write the reserved sub and aud claims in Keycloak 26.8.2.

  • securityhighCVE-2026-97175 IdP email auto-linking

    Applies if you use IdP email auto-linking.

    CVE-2026-97175 fixes unverified IdP email auto-linking that could enable account takeover in Keycloak 26.8.2.

  • securityhighCVE-2026-82965 SAML SOAP endpoint parsing

    Applies if you expose a SAML SOAP endpoint.

    CVE-2026-82965 fixes unbounded XML parsing in the SAML SOAP endpoint in Keycloak 26.8.2.

  • securityhighCVE-2026-92855 SAML Broker Holder-of-Key assertions

    Applies if you use SAML Broker.

    CVE-2026-92855 fixes the SAML Broker acceptance of Holder-of-Key assertions without proof of key possession in Keycloak 26.8.2.

  • securityhighCVE-2026-97848 protocol mapper JSON handling

    Applies if you use Protocol mapper and configure jsonType=JSON.

    CVE-2026-97848 fixes a protocol mapper configured with jsonType=JSON that could bypass the CVE-2026-16102 fix in Keycloak 26.8.2.

  • securitymediumCVE-2026-105305 Device Authorization Grant enforcement

    Applies if you use Device Authorization Grant.

    CVE-2026-105305 fixes enforcement of the per-client minimum.acr.value requirement in the Device Authorization Grant in Keycloak 26.8.2.

  • securitymediumCVE-2026-107623 OIDC DCR offline token revocation

    Applies if you use OIDC DCR.

    CVE-2026-107623 fixes the OIDC DCR read-modify-write behavior that could silently disable offline token revocation during backchannel logout in Keycloak 26.8.2.

  • securitymediumCVE-2026-97174 CIBA sub parameter handling

    Applies if you use CIBA.

    CVE-2026-97174 fixes sub parameter injection in CIBA that could cause attacker authentication to issue victim tokens in Keycloak 26.8.2.

  • securitymediumCVE-2026-96448 FGAP v2 composite role mapping

    Applies if you enable FGAP v2.

    CVE-2026-96448 fixes FGAP v2 composite-blind role mapping that allowed manage-users to assign a wrapper containing realm-admin in Keycloak 26.8.2.

  • securityCVE-2026-112201 MySQL and MariaDB login-failure upserts

    Applies if you depend on MySQL or MariaDB.

    CVE-2026-112201 fixes login-failure upsert handling that trusted the affected-row count returned by MySQL or MariaDB in Keycloak 26.8.2.

  • securityCVE-2026-97367 DCR claim substitution

    Applies if you use DCR.

    CVE-2026-97367 fixes DCR azp and sid claim substitution through User Property mappers in the Account REST session flow in Keycloak 26.8.2.

  • securityCVE-2026-96547 DCR registration-time claim paths

    Applies if you use DCR.

    CVE-2026-96547 fixes the DCR registration-time claim-path gap that allowed attribute mappers to forge realm_access.roles from user-editable fields in Keycloak 26.8.2.

  • securityCVE-2026-96460 token exchange expiration

    Applies if you use token exchange.

    CVE-2026-96460 fixes token exchange behavior that could produce tokens with unlimited expiration in Keycloak 26.8.2.

  • securityCVE-2026-96447 stateless token identity rebinding

    Applies if you use Stateless token.

    CVE-2026-96447 fixes the preferred_username fallback for stateless tokens after client recreation in Keycloak 26.8.2.

  • securityCVE-2026-92856 SAML Identity Broker ProxyRestriction

    Applies if you use SAML Identity Broker.

    CVE-2026-92856 fixes the SAML Identity Broker handling of ProxyRestriction and forbidden downstream assertion issuance in Keycloak 26.8.2.

  • securityCVE-2026-19688 Admin API audience check

    Applies if you expose the Admin API.

    CVE-2026-19688 adds the missing audience check to the Admin API in Keycloak 26.8.2.

  • securitySAML SLO issuer validation

    Applies if you use SAML SLO.

    Keycloak 26.8.2 fixes SAML SLO handling that allowed an unsigned client to impersonate a victim service provider through a spoofed issuer.

  • securityOrganization domain gate email verification

    Applies if you configure an organization domain gate.

    Keycloak 26.8.2 fixes handling of unverified broker email when satisfying an organization domain gate.

All 18 other recorded changesfixes 17 · value changes 1

fixes (17)

  • Realm client-session stats disclose hidden clients under FGAP v2
  • JWE key-management algorithm not validated against provisioned key algorithm on request object decryption
  • Harden PathMatcher URI normalization for leading dot segments and authority-less schemes
  • Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak&#39;s Brute Force protection
  • FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it
  • Realm import: JSON representation migration fails with LazyInitializationException when a users file is present
  • Much open UDP Sockets after some Time
  • Theme resources intermittently 404 on a cold gzip cache
  • BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle
  • IdentityBrokerService fires duplicate error events and reflects user input in responses
  • Concurreny issue in JAXPValidationUtil
  • Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN
  • ISPN000427 timeout on distributed caches when entry lock is contended during topology change
  • Original exception is swallowed by NullPointerException when acquiring the database lock fails
  • NullPointerException in KeycloakLogFilter after failed startup as the Profile is no longer initialized
  • Periodic user storage sync runs at twice the configured period when a sync takes longer than ~1 second
  • Validate keycloak locale before setting to KEYCLOAK_LOCALE Cookie

value changes (1)

  • Upgrade to Quarkus 3.40.1.1
Add Keycloak to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Keycloak releases →