# Keycloak 26.7.3 > Security · 2026-08-31 A security-focused maintenance release with authorization, disclosure, and token-handling fixes across the platform. It also includes correctness and performance fixes. ## Action needed - **[security]** `CVE-2026-19729` relative path traversal protection - This release fixes the remaining relative path traversal issue that enabled filesystem probing in `core`, following `CVE-2026-9083`. ## Check if affected - **[security · high]** `CVE-2026-35563` LDAP certificate hostname verification - Applies if you use `LDAP client implementation`. - This release fixes certificate hostname verification in the LDAP client implementation identified by `CVE-2026-35563`. - **[security · medium]** `CVE-2026-16093` signed-JWT assertion enforcement - Applies if you use `oidc`. - This release prevents unsigned assertion headers from bypassing the required signed-JWT assertion policy in `oidc`. - **[security · medium]** `CVE-2026-16072` organization member creation authorization - Applies if you use `organizations`. - This release prevents organization managers from creating managed members through stored registration links without `manage-users` in `organizations`. - **[security · medium]** `CVE-2026-16108` hidden group disclosure - Applies if you use `admin/fine-grained-permissions` under FGAP v2. - This release prevents realm default-group reads from disclosing hidden groups under FGAP v2 in `admin/fine-grained-permissions`. - **[security · medium]** `CVE-2026-16105` `RoleContainerResource` authorization - Applies if you use `admin/rbac`. - This release adds per-role authorization to `RoleContainerResource` composite endpoints in `admin/rbac`. - **[security · medium]** `CVE-2026-16089` authorization code session binding - Applies if you use `oidc`. - This release prevents authorization codes from being retargeted to another client session in `oidc`. - **[security · medium]** `CVE-2026-16104` reCAPTCHA secret protection - Applies if you use `admin/fine-grained-permissions`. - This release prevents authenticator configuration surfaces from exposing raw reCAPTCHA secrets in `admin/fine-grained-permissions`. - **[security · medium]** `CVE-2026-16106` admin role-composite deletion authorization - Applies if you use `admin/fine-grained-permissions`. - This release corrects authorization for admin role-composite deletion so delegated administrators cannot remove privileged child roles in `admin/fine-grained-permissions`. - **[security · medium]** `CVE-2026-17059` per-user view filtering - Applies if you use `admin/fine-grained-permissions`. - This release applies the per-user view filter to `GET /roles/{role}/users`, preventing user PII disclosure in `admin/fine-grained-permissions`. - **[security · medium]** `CVE-2026-18218` client not-before revocation - Applies if you use `oidc`. - This release honors client not-before revocation when the realm not-before value is older but nonzero in `oidc`. - **[security · medium]** `CVE-2026-18215` Microsoft `token-exchange` tenant restriction - Applies if you use `token-exchange`. - This release enforces the configured tenant for Microsoft external access-token exchange in `token-exchange`. - **[security · medium]** `CVE-2026-18201` organization broker binding authorization - Applies if you use `organizations`. - This release prevents generic identity-provider creation from binding brokers to organizations without `manage-organizations` in `organizations`. - **[security · medium]** `CVE-2026-18214` Google `token-exchange` domain restriction - Applies if you use `token-exchange`. - This release enforces the hosted-domain restriction for Google external access-token exchange in `token-exchange`. - **[security · medium]** `CVE-2026-18571` group assignment authorization - Applies if you use `admin/fine-grained-permissions` under FGAP V2. - This release prevents group assignment bypass during `POST /users`, blocking the addition of unpermitted groups under FGAP V2 in `admin/fine-grained-permissions`. - **[security · medium]** `CVE-2026-18572` UMA time-policy enforcement - Applies if you use `authorization-services`. - This release prevents a UMA claim token from overriding the authorization time-policy clock in `authorization-services`. - **[security · medium]** `CVE-2026-18573` client access-type condition evaluation - Applies if you use `oidc`. - This release evaluates client access-type condition updates against the new client type in `oidc`. - **[security · medium]** `CVE-2026-18570` full-scope-disabled client policy validation - Applies if you use `oidc`. - This release prevents full-scope-disabled client policy validation from being bypassed by omitting `fullScopeAllowed` in `oidc`. - **[security · medium]** `CVE-2026-79652` jwt-bearer consent enforcement - Applies if you use `oidc`. - This release enforces `consentRequired` for the Keycloak jwt-bearer authorization grant in `oidc`. - **[security · low]** `CVE-2026-18209` `redirect_uri` response-parameter validation - Applies if you use `oidc`. - This release completes the `redirect_uri` OIDC response-parameter injection fix by checking forbidden parameters in the URL fragment as well as the query string. - **[security]** Admin API hidden client role metadata filtering - Applies if you use `admin/fine-grained-permissions` under FGAP v2. - This release prevents Admin API user and group role-mapping endpoints from disclosing hidden client role metadata under FGAP v2 in `admin/fine-grained-permissions`. - **[security]** Admin client protocol condition validation - Applies if you use `oidc`. - This release prevents the client-protocol condition from being bypassed on admin client creation by omitting the protocol in `oidc`. - **[security]** SAML ECP client-existence disclosure - Applies if you use `saml`. - This release prevents the SAML ECP faultstring from disclosing client existence and completes the fix for `CVE-2026-9794`. ## Other recorded changes - 13 (defect_corrected 13) [Full analysis](https://ratatosk.io/en/releases/keycloak/26.7.3) [Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.7.3)