# Keycloak 26.8.0

> Security · 2026-10-01

A security-focused release with broad fixes across identity brokering, OIDC, OID4VCI, SCIM, LDAP, session handling, and credential policies. It also changes brute-force detection to persist data in the database by default, adds administration and deployment capabilities, and deprecates several compatibility, clustering, and session features.

## Action needed
- **[security · medium]** `CVE-2026-12388` IdP mapper admin-role escalation
  - Corrects IdP mapper admin-role escalation tracked as `CVE-2026-12388`.
- **[security · medium]** `CVE-2026-19608` path-specific group-policy matching
  - Corrects name-only group claims that could let same-named groups satisfy path-specific group policies.
- **[security · medium]** `com.fasterxml.jackson.core:jackson-databind` 2.22.0
  - Updates `com.fasterxml.jackson.core:jackson-databind` to version `2.22.0` for `CVE-2026-54515` and `CVE-2026-59889`.
- **[security · medium]** `io.netty:netty-codec-http` 4.1.136.Final
  - Updates `io.netty:netty-codec-http` to version `4.1.136.Final` for `CVE-2026-59903`.
- **[security]** The `secure-client-node-hostname` client policy executor
  - Adds the `secure-client-node-hostname` client policy executor to protect against server-side request forgery.
- **[security]** SMTP masked-credential destination verification
  - Corrects SMTP masked-credential substitution that did not verify unchanged destination fields.
- **[security]** Same-second refresh-token rotation
  - Corrects same-second refresh-token rotation that allowed replay of stale tokens.
- **[security]** Cache-miss session rehydration
  - Corrects cache misses rehydrating deleted sessions from the database.
- **[security]** User partial-filter ancestor-group denies
  - Corrects user partial filters ignoring ancestor group-membership denies.
- **[security]** Client-update admin-event private keys
  - Corrects client-update admin events retaining private-key attributes.
- **[security]** Registration access tokens in admin events
  - Corrects registration access-token regeneration storing live bearer tokens in admin events.
- **[security]** RP-initiated logout `initiating_idp` handling
  - Corrects RP-initiated logout suppressing upstream broker logout through a forged `initiating_idp`.
- **[security]** `ComponentResource.getSubcomponentConfig` class loading
  - Restricts unrestricted `Class.forName()` use on the query parameter in `ComponentResource.getSubcomponentConfig`.
- **[security]** Read-only client-type properties during registration
  - Prevents bypass of read-only client-type properties during registration.
- **[security]** Absence-based completion predicates
  - Corrects absence-based completion checks that could not distinguish consumed events from never-persisted events.
- **[security]** Bulk HQL `executeUpdate` classification
  - Corrects bulk HQL `executeUpdate` bypassing `AsyncCommitIntegrator` security classification.
- **[security]** Password denylist Turkish-locale handling
  - Corrects a Turkish-locale bypass of the password denylist.
- **[security]** Token-exchange delegation-token actor validation
  - Corrects token-exchange provider routing that allowed delegation tokens to bypass actor validation through standard exchange.
- **[breaking]** Database persistence for brute-force detection data
  - Brute-force detection data is persisted in the database by default.
- **[breaking]** Persistent login failures as the default
  - Makes persistent login failures the default.
- **[breaking]** `IdentityProviderModel.getOrganizationId()` removal
  - Removes `IdentityProviderModel.getOrganizationId()`.

## Check if affected
- **[security · medium]** `CVE-2026-14781` OIDC broker email-verification handling
  - Applies if you use the OIDC broker.
  - Corrects OIDC broker handling that could mark unverified email addresses as verified through `id_token` and userinfo processing.
- **[security · low]** `CVE-2026-4633` Organizations identity-first login
  - Applies if you use organizations.
  - Corrects identity-first login user enumeration when Organizations is enabled, tracked as `CVE-2026-4633`.
- **[security]** LDAP bind credentials after connection URL changes
  - Applies if you use LDAP.
  - Corrects sending LDAP bind credentials to a new server after a connection URL change.
- **[security]** Client GET endpoint secret exposure
  - Applies if you use Client GET endpoints.
  - Corrects Client GET endpoints returning raw client secrets to holders of the `view-clients` role.
- **[security]** Client private-key database storage and generate endpoints
  - Applies if you use generate endpoints.
  - Stops storing client private keys in the database and deprecates the generate endpoints.
- **[security]** `Client baseUrl` URI-scheme validation
  - Applies if you use `Client baseUrl`.
  - Adds URI-scheme validation for `Client baseUrl` during realm and partial import.
- **[security]** `allowed-protocol-mappers` enforcement in the Admin REST API
  - Applies if you use `allowed-protocol-mappers`.
  - Enforces the `allowed-protocol-mappers` client policy executor for Admin REST API protocol-mapper operations.
- **[security]** OIDC PAR request-URI realm binding
  - Applies if you use OIDC.
  - Corrects PAR request URIs being stored in a single-use cache without realm binding.
- **[security]** OID4VCI issued-credential deletion ownership validation
  - Applies if you use OID4VCI.
  - Adds ownership validation to the Account API delete endpoint for issued verifiable credentials.
- **[security]** Parameterized Scopes username enumeration
  - Applies if you configure Parameterized Scopes.
  - Corrects pre-authentication username enumeration through Parameterized Scopes username and delegation scope types.
- **[security]** Parameterized Scopes prefix resolution
  - Applies if you configure Parameterized Scopes.
  - Corrects prefix resolution that allowed a permissive Parameterized Scope to shadow a stricter scope.
- **[security]** `CustomRegexScopeType` input length
  - Applies if you configure Parameterized Scopes.
  - Limits unbounded input passed to the administrator-defined regex in `CustomRegexScopeType`.
- **[security]** SCIM Groups member-operation administration checks
  - Applies if you use the SCIM Groups endpoint.
  - Corrects missing `isAdminUser` enforcement for SCIM Groups endpoint member operations.
- **[security]** SCIM PATCH `maxOperations` enforcement
  - Applies if you use SCIM and configure `maxOperations`.
  - Enforces `maxOperations` for SCIM PATCH operation lists.
- **[security]** Client API v2 `addClient()` authorization
  - Applies if you use Client API v2.
  - Corrects temporary client creation through the `addClient()` shim bypassing realm-level authorization.
- **[security]** OID4VCI `key_attestations_required` enforcement
  - Applies if you use OID4VCI and configure `key_attestations_required`.
  - Enforces `key_attestations_required` when the proof JWT lacks a key-attestation header.
- **[security]** OID4VCI key-attestation `x5c` validation
  - Applies if you use OID4VCI.
  - Corrects validation of key-attestation `x5c` chains against system CA certificates without EKU or revocation checks.
- **[security]** `/create-credential-offer` expiration parameter
  - Applies if you use `/create-credential-offer`.
  - Constrains the `expire` parameter on `/create-credential-offer` to prevent indefinite pre-authorized codes.
- **[security]** OID4VCI LD-VC remote `@context` retrieval
  - Applies if you use OID4VCI.
  - Restricts LD-VC signer retrieval of remote `@context` URLs over HTTP.
- **[security]** OID4VCI credential-subject `did` attributes
  - Applies if you use OID4VCI.
  - Corrects use of a user-editable `did` attribute as a credential subject with only realm-local uniqueness.
- **[security]** Credential-request RSA encryption algorithms
  - Applies if you use OID4VCI.
  - Corrects credential request decryption accepting `RSA1_5` for `RSA-OAEP-256` encryption keys.
- **[security]** SCIM Users filter group-membership disclosure
  - Applies if you use SCIM Users filters.
  - Corrects SCIM Users filters leaking hidden group membership under FGAP.
- **[security]** SCIM Groups filter user-membership disclosure
  - Applies if you use SCIM Groups filters.
  - Corrects SCIM Groups filters leaking hidden user membership under FGAP.
- **[security]** SCIM mapped-attribute view permissions
  - Applies if you use SCIM.
  - Corrects SCIM reads and filters bypassing user-profile view permissions for mapped attributes.
- **[security]** SD-JWT signature-algorithm verification
  - Applies if you use SD-JWT.
  - Corrects SD-JWT verification accepting a signature algorithm different from the JWS header.
- **[security]** Server info database-detail exposure
  - Applies if you use Server info.
  - Corrects Server info exposing database operational details to `view-realm` administrators.
- **[security]** SAML inbound `LogoutResponse` signature verification
  - Applies if you use `LogoutResponse`.
  - Adds signature verification for inbound SAML `LogoutResponse` messages.
- **[security]** OIDC Dynamic Client Registration PUT `scope` handling
  - Applies if you use OIDC Dynamic Client Registration PUT.
  - Corrects an unauthenticated HTTP 500 error on OIDC Dynamic Client Registration PUT requests through the `scope` field.
- **[security]** Root-path redirect security headers
  - Applies if you configure `http-relative-path`.
  - Corrects missing security headers on root-path redirects when `http-relative-path` is configured.
- **[security]** OID4VCI `RSA1_5` credential-request handling
  - Applies if you use OID4VCI.
  - Corrects an unauthenticated `RSA1_5` padding oracle in OID4VCI credential requests.
- **[security]** OID4VC issued-credential deletion scope
  - Applies if you use OID4VC.
  - Scopes OID4VC issued-credential deletion to the path user and realm.
- **[security]** Concurrent WebAuthn registration completion
  - Applies if you use WebAuthn.
  - Corrects concurrent WebAuthn registration completion persisting multiple passwordless credentials.
- **[security]** LDAP password-policy response-control parsing
  - Applies if you use LDAP.
  - Corrects LDAP password-policy response-control parsing, including warning and error tag collisions and uncaught `NumberFormatException` login failures.
- **[security]** SCIM membership PATCH audit events
  - Applies if you use SCIM.
  - Corrects SCIM membership PATCH audit events omitting the changed relationship.
- **[security]** SCIM legacy query-role memberships
  - Applies if you use SCIM and do not enable FGAP.
  - Corrects SCIM legacy query roles inferring cross-resource memberships when FGAP is disabled.
- **[security]** SCIM Group DELETE administrative-resource protection
  - Applies if you use SCIM Group DELETE.
  - Corrects SCIM Group DELETE bypassing administrative-resource protection through cascades.
- **[security]** SCIM user-deletion security-state cleanup
  - Applies if you use SCIM.
  - Corrects SCIM user deletion skipping security-state cleanup.
- **[security]** Brute-force reset-boundary failure counters
  - Applies if you use brute-force detection.
  - Corrects concurrent failures at the brute-force reset boundary erasing newly recorded attempts.
- **[security]** `LoginFailureEntity` async-commit classification
  - Applies if you use `LoginFailureEntity`.
  - Corrects `LoginFailureEntity` async-commit classification discarding failure counters after failover.
- **[security]** Multi-Cluster v2 ephemeral-data commits
  - Applies if you enable Multi-Cluster v2.
  - Corrects Multi-Cluster v2's no-data-loss RPO conflicting with default asynchronous commits of ephemeral data.
- **[security]** Credential-offer client-role namespace handling
  - Applies if you use credential offers.
  - Corrects same-named client roles authorizing credential offers for unintended targets.
- **[security]** OID4VCI rotated refresh-token reuse
  - Applies if you use OID4VCI.
  - Corrects reuse of a rotated OID4VCI refresh token repeatedly reissuing credential authority.
- **[security]** SD-JWT credential lifetime attributes
  - Applies if you use SD-JWT.
  - Corrects user-editable mapped attributes extending SD-JWT credentials beyond the issuer-configured lifetime.
- **[security]** OID4VCI approved attribute snapshots
  - Applies if you use OID4VCI.
  - Corrects credential issuance ignoring the administrator-approved attribute snapshot.
- **[security]** OID4VCI credential-request authentication order
  - Applies if you use OID4VCI.
  - Corrects unauthenticated credential requests triggering private-key JWE decryption before bearer authentication.
- **[security]** OID4VCI targeted-offer refresh handling
  - Applies if you use OID4VCI.
  - Corrects refreshed stolen targeted offers bypassing offer-required issuance for another user.
- **[security]** OID4VCI SD-JWT array-claim disclosure
  - Applies if you use OID4VCI.
  - Corrects OID4VCI SD-JWT issuance that made array claims all-or-nothing disclosures.
- **[security]** `kcadm` existing configuration-file permissions
  - Applies if you use `kcadm`.
  - Corrects `kcadm` preserving world-readable permissions on existing configuration files.
- **[security]** SCIM search filter values in debug logs
  - Applies if you use SCIM.
  - Corrects SCIM search writing raw filter values to debug logs.
- **[security]** Recovered-site security configuration
  - Applies if you use sites.
  - Corrects recovered sites enforcing stale security configuration for up to one hour.
- **[security]** OID4VCI access-token endpoint scope
  - Applies if you use OID4VCI.
  - Restricts OID4VCI access tokens to the credential endpoint.
- **[security]** OID4VCI decompression limits
  - Applies if you use OID4VCI.
  - Corrects an OID4VCI memory leak and adds a decompression limit.
- **[security]** Organization-IdP link policies during realm import
  - Applies if you use organizations.
  - Corrects realm import resetting the organization-IdP link policy to permissive defaults.
- **[security]** Organization-link access in identity-provider reads
  - Applies if you use organizations.
  - Corrects identity-provider reads disclosing organization links outside the caller's scope.
- **[security]** Client-scoped endpoint view restrictions
  - Applies if you use client-scoped endpoints.
  - Corrects `view-clients` bypassing `view-users` restrictions through client-scoped endpoints.
- **[security]** Admin v2 API PATCH secret-rotation policy
  - Applies if you use the Admin v2 API.
  - Corrects Admin v2 API PATCH bypassing the client secret-rotation policy.
- **[security]** OIDC logout `client_id` log sanitization
  - Applies if you use the OIDC logout endpoint.
  - Corrects log injection through an unsanitized `client_id` in the OIDC logout endpoint.
- **[security]** SCIM resource-ID phishing
  - Applies if you use SCIM.
  - Corrects SCIM resource-ID phishing.
- **[security]** Admin API v2 client-secret exposure
  - Applies if you use `admin/api`.
  - Corrects Admin API v2 returning plaintext client secrets to holders of the `view-clients` role.
- **[breaking]** SCIM username updates with Edit username disabled
  - Applies if you use SCIM.
  - Prevents SCIM API username updates when the Edit username setting is disabled.
- **[security]** Single-valued organization mapper membership
  - Applies if you use identity brokering.
  - Corrects a single-valued organization mapper emitting an attacker-selected non-member organization.
- **[security]** Organization group-representation role metadata
  - Applies if you use organizations.
  - Corrects organization group representations leaking client and realm role metadata to unauthorized administrators.
- **[breaking]** Keycloak Realm Operator end of life
  - Applies if you use the Keycloak Realm Operator.
  - Ends support for the Keycloak Realm Operator.
- **[breaking]** Device-flow client scope validation
  - Applies if you use OIDC.
  - Makes device flow reject a scope parameter containing a scope not permitted for the client.

## Plan ahead
- **[deprecated]** Multi-cluster v1 (`multi-site`) deprecation
  - Applies if you enable `multi-site`.
  - removal date not announced
  - Deprecates Multi-cluster v1, the `multi-site` feature.
- **[deprecated]** The `login-failures:v1` behavior, deprecated
  - Applies if you enable `login-failures:v1`.
  - The former in-memory behavior remains available as `login-failures:v1`, but is deprecated.
- **[deprecated]** Kerberos Credential delegation deprecation
  - Applies if you use Kerberos.
  - Deprecates Kerberos Credential delegation.
- **[deprecated]** Legacy OIDC client-switch deprecation
  - Applies if you configure `OpenID Connect Compatibility Modes`.
  - Deprecates legacy OIDC client switches from `OpenID Connect Compatibility Modes`.
- **[deprecated]** Volatile-session deprecation
  - Applies if you configure volatile sessions.
  - Deprecates volatile sessions and adds an option to opt out of session caching.
- **[deprecated]** `Full scope allowed` client-switch deprecation
  - Applies if you configure `Full scope allowed`.
  - Deprecates the `Full scope allowed` client switch.
- **[deprecated]** Non-OIDC client-registration provider deprecation
  - Applies if you use client registration providers.
  - Deprecates client registration providers other than OIDC.
- **[deprecated]** `AUTH_SESSION_ID` sticky-session routing deprecation
  - Applies if you configure the `AUTH_SESSION_ID` cookie.
  - Deprecates routing sticky sessions from the `AUTH_SESSION_ID` cookie.
- **[deprecated]** Clusterless feature deprecation
  - Applies if you enable `clusterless`.
  - Deprecates the clusterless feature.
- **[deprecated]** In-memory login-failure deprecation
  - Applies if you enable in-memory login failures.
  - Deprecates in-memory login failures.

## Other recorded changes
- 258 (defect_corrected 158, value_changed 50, added 37, constraint_changed 9, default_changed 3, renamed 1)

[Full analysis](https://ratatosk.io/en/releases/keycloak/26.8.0)

[Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.8.0)