# Keycloak 26.7.5

> Security · 2026-09-30

A security-focused maintenance release with CVE fixes across authentication and authorization flows, along with updates to affected dependencies. It also contains correctness and stability fixes, including a new client-role requirement for Identity Provider management in the admin UI.

## Action needed
- **[security · critical]** `CVE-2026-84939` `org.freemarker:freemarker` dependency
  - The `org.freemarker:freemarker` dependency is updated for `CVE-2026-84939`.
- **[security · high]** `CVE-2025-66021` `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` dependency
  - The `com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer` dependency is updated for `CVE-2025-66021`.
- **[security · high]** `CVE-2026-8798` `org.bouncycastle:bc-fips` dependency
  - The `org.bouncycastle:bc-fips` dependency is updated for `CVE-2026-8798`.
- **[security · high]** `CVE-2026-13505` `org.bouncycastle:bc-fips` dependency
  - The `org.bouncycastle:bc-fips` dependency is updated for `CVE-2026-13505`.

## Check if affected
- **[security · medium]** `CVE-2026-16103` and `CVE-2026-9798` CIBA lockout bypass fixes
  - Applies if you use `oidc`.
  - `CVE-2026-16103` fixes an incomplete fix for `CVE-2026-9798`, which affected CIBA brute-force lockout at token redemption in `oidc`.
- **[security · medium]** `CVE-2026-18203` group policy path matching
  - Applies if you use `authorization-services`.
  - `CVE-2026-18203` fixes group policy child-extension matching of sibling group path prefixes in `authorization-services`.
- **[security · medium]** `CVE-2026-18207` source-group condition enforcement
  - Applies if you use `oidc`.
  - `CVE-2026-18207` fixes source-group condition matching for duplicate group names, which could skip negative-logic enforcement in `oidc`.
- **[security · medium]** `CVE-2026-18208` introspection response claims
  - Applies if you use `oidc`.
  - `CVE-2026-18208` fixes inactive out-of-audience introspection responses that could include a signed JWT claim in `oidc`.
- **[security · medium]** `CVE-2026-18211` `secure-client-uris` localhost exception
  - Applies if you use `oidc`.
  - `CVE-2026-18211` fixes the `secure-client-uris` localhost exception, which accepted localhost-prefixed attacker domains in `oidc`.
- **[security · medium]** `CVE-2026-89298` confidential client secret disclosure
  - Applies if you use `oidc`.
  - `CVE-2026-89298` fixes disclosure of a confidential client secret to the `view-clients` role through Client Registration GET in `oidc`.
- **[security · medium]** `CVE-2026-88770` Device Authorization Grant lockout
  - Applies if you use `oidc`.
  - `CVE-2026-88770` fixes Device Authorization Grant token issuance for brute-force-locked accounts in `oidc`. The issue is identified as a sibling of `CVE-2026-9798`.
- **[security · medium]** `CVE-2026-93999` `token-exchange` refresh for disabled clients
  - Applies if you use `token-exchange`.
  - `CVE-2026-93999` fixes `token-exchange` refresh continuing to issue tokens for a disabled audience client in `token-exchange`.
- **[security · low]** `CVE-2026-18206` client policy wildcard matching
  - Applies if you use `oidc`.
  - `CVE-2026-18206` fixes client policy source-host wildcard matching so it does not match non-subdomain suffixes in `oidc`.
- **[security · low]** `CVE-2026-18217` SAML Redirect Binding parameters
  - Applies if you use `saml`.
  - `CVE-2026-18217` fixes SAML Redirect Binding parameter pollution in `saml`.
- **[breaking]** Client roles required for Identity Provider management
  - Applies if you use `admin/ui`.
  - Managing Identity Providers in the `admin/ui` now requires client roles in the realm.

## Other recorded changes
- 13 (defect_corrected 11, value_changed 2)

[Full analysis](https://ratatosk.io/en/releases/keycloak/26.7.5)

[Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.7.5)