# Keycloak 26.8.1

> Security · 2026-10-13

A security-focused maintenance release with vulnerability fixes across authentication, administration, identity brokering, authorization, token exchange, and observability. It also updates vulnerable `jackson-databind` and `simple-git` dependencies and includes further corrections in clustering, organizations, token handling, and HTTP processing.

## Action needed
- **[security · high]** CVE-2026-91777 `com.fasterxml.jackson.core:jackson-databind` dependency
  - The `com.fasterxml.jackson.core:jackson-databind` dependency was updated for CVE-2026-91777.
- **[security · medium]** `CVE-2026-94001` admin credential deletion authorization
  - This release fixes `CVE-2026-94001`, which allowed an admin credential deletion to bypass denied reset-password permission in admin fine-grained permissions.
- **[security · medium]** `CVE-2026-94215` cross-realm resource access
  - This release fixes `CVE-2026-94215`, which enabled cross-realm realm resource read and write through the per-request session-level cache in `RealmCacheSession`.
- **[security · medium]** `CVE-2026-97177` user-update authorization
  - This release fixes `CVE-2026-97177`, which allowed a generic user update to bypass denied reset-password permission.
- **[security]** `tools.jackson.core:jackson-databind` dependency updates
  - The `tools.jackson.core:jackson-databind` dependency was updated for multiple CVEs.
- **[security]** `simple-git` dependency updates
  - The `simple-git` dependency was updated for multiple CVEs.
- **[security]** Username enumeration through empty-password timing
  - This release fixes username enumeration through empty-password timing in authentication.

## Check if affected
- **[security · medium]** `CVE-2026-15943` identity provider client-secret reuse
  - Applies if you use `OIDC identity provider` and configure `token URL`.
  - This release fixes `CVE-2026-15943`, which caused an OIDC identity provider update to reuse a masked client secret after token URL changes in identity brokering.
- **[security · medium]** `CVE-2026-82968` identity-provider account linking
  - Applies if you use `null` or `GitHub identity provider`.
  - This release fixes `CVE-2026-82968`, which allowed persistent wrong-account linking through the `null` or GitHub identity provider.
- **[security · medium]** `CVE-2026-94000` delegated-admin role escalation
  - Applicability is not stated in the release notes.
  - This release fixes `CVE-2026-94000`, which allowed a delegated admin with only `manage-users` to become `realm-admin` through group membership or group creation mapped to an admin role.
- **[security · medium]** `CVE-2026-94213` policy evaluation authorization
  - Applies if you use the `Authorization Services policy evaluation endpoint`.
  - This release fixes `CVE-2026-94213`, which involved missing user-view authorization in the Authorization Services policy evaluation endpoint and an incomplete fix for CVE-2026-37978.
- **[security · medium]** `CVE-2026-96446` PAR single-use enforcement
  - Applies if you use `PAR`.
  - This release fixes `CVE-2026-96446`, which allowed a PAR single-use bypass through `prompt=none`.
- **[security · medium]** `CVE-2026-96445` conditional OTP proxy handling
  - Applicability is not stated in the release notes.
  - This release fixes `CVE-2026-96445`, which allowed conditional OTP to trust skip headers on untrusted proxy paths.
- **[security · medium]** `CVE-2026-95503` Kerberos password authentication
  - Applies if you configure `Kerberos password authentication`.
  - This release fixes `CVE-2026-95503`, which enabled a potential KDC spoofing attack when Kerberos password authentication was enabled.
- **[security · medium]** `CVE-2026-97311` Admin REST API group visibility
  - Applies if you use the `Admin REST API`.
  - This release fixes `CVE-2026-97311`, which allowed the `roles/{role-name}/groups` endpoint in the Admin REST API to disclose groups the caller could not view. The change addresses an incomplete fix from the 26.7.2 hardening.
- **[security · medium]** `CVE-2026-97846` Standard Token Exchange certificate binding
  - Applies if you use `Standard Token Exchange` and configure `mTLS certificate binding`.
  - This release fixes `CVE-2026-97846`, which allowed Standard Token Exchange to bypass required mTLS certificate binding and issue an active bearer token when no client certificate was supplied.
- **[security · medium]** `CVE-2026-103884` X.509 CRL path traversal
  - Applies if you use `X.509 CRL Distribution Point`.
  - This release fixes `CVE-2026-103884`, which allowed a client-supplied CRL path from an X.509 CRL Distribution Point to escape `$KC_HOME/conf`.
- **[security · medium]** `CVE-2026-107121` SMTP STARTTLS handling
  - Applies if you configure `SMTP starttls`.
  - This release fixes `CVE-2026-107121`, which allowed `SMTP starttls=true` to permit plaintext credential and message downgrade.
- **[security · medium]** FGAP v2 custom role injection, CVE-2026-4629
  - Applies if you use `FGAP v2` and `oidc-hardcoded-role-mapper`.
  - This release fixes FGAP v2 custom role injection through `oidc-hardcoded-role-mapper`, which bypassed `removeTransientAdminRoles`. The change addresses an incomplete fix for CVE-2026-4629.
- **[security · low]** `CVE-2026-18569` OIDC broker logout-token validation
  - Applies if you do not configure `signature validation`.
  - This release fixes `CVE-2026-18569` in OIDC broker backchannel logout, which accepted unsigned forged logout tokens when signature validation was disabled.
- **[security · low]** `CVE-2026-94218` 2FA setup enforcement
  - Applies if you use `/realms/{realm}/login-actions/restart`.
  - This release fixes `CVE-2026-94218`, which allowed 2FA setup enforcement to be bypassed through the `/realms/{realm}/login-actions/restart` endpoint.
- **[security · low]** `CVE-2026-94217` UMA scope isolation
  - Applies if you use `UMA`.
  - This release fixes `CVE-2026-94217`, which allowed UMA scopes to merge across resource owners through a name collision in `resolveResourcePermission`.
- **[security · low]** `CVE-2026-101333` broker-login metric series
  - Applies if you use the `broker login endpoint`.
  - This release fixes `CVE-2026-101333`, which allowed unbounded metric series creation through the `idp` tag on the broker login endpoint.
- **[security]** Kerberos TRACE logging credential exposure
  - Applies if you use `Kerberos` and configure `TRACE logging`.
  - This release fixes Kerberos TRACE logging that recorded complete SPNEGO credentials.
- **[security]** Dynamic client registration SSF event access
  - Applies if you use `Dynamic client registration`.
  - This release fixes dynamic client registration self-enabling privileged SSF event access.
- **[security]** SAML SLO session termination
  - Applies if you use `SAML SLO`.
  - This release fixes SAML SLO handling that allowed unauthenticated arbitrary session termination through a `LogoutRequest` with `SessionIndex`.
- **[security]** SAML broker HTTP-Redirect signature verification, ANT-2026-HQ54RPF9
  - Applies if you use `SAML broker HTTP-Redirect binding`.
  - This release fixes SAML broker HTTP-Redirect binding signature verification when a semicolon parameter separator caused verification over a different `SAMLResponse` than the one processed. The change addresses unauthenticated login as an arbitrary user, tracked as ANT-2026-HQ54RPF9.
- **[security]** FGAP v2 LDAP user search results
  - Applies if you use `FGAP v2` and `LDAP`.
  - This release fixes FGAP v2 search results that returned non-imported LDAP users to `query-users-only` delegated admins.

## Other recorded changes
- 19 (defect_corrected 19)

[Full analysis](https://ratatosk.io/en/releases/keycloak/26.8.1)

[Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.8.1)