# Keycloak 26.8.2 > Security · 2026-11-05 A security-heavy maintenance release with fixes for authentication, authorization, denial-of-service, data-integrity, and other security issues. It also contains dependency updates and ordinary bug fixes, so the security fixes are the main concern for affected Keycloak deployments. ## Action needed - **[security · critical]** `CVE-2026-111497` bundled Brotli decoder bounds handling - `CVE-2026-111497` fixes an out-of-bounds write in the bundled Brotli decoder in Keycloak 26.8.2. - **[security · high]** `CVE-2026-97847` sessionless token principal replacement - `CVE-2026-97847` fixes replacement of a sessionless token principal by a client manager in Keycloak 26.8.2. - **[security · high]** `CVE-2026-103112` authentication race - `CVE-2026-103112` fixes an account takeover caused by an authentication race in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-92358` cross-browser fallback proof handling - `CVE-2026-92358` fixes the cross-browser fallback proof behavior after successful account linking and self-service unlink in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-107889` login-page stored XSS - `CVE-2026-107889` fixes a stored cross-site scripting issue on the login page involving a `kcSanitize` bypass in Keycloak 26.8.2. - **[security]** `CVE-2026-107124` session takeover through `id_token_hint` - `CVE-2026-107124` fixes session takeover through victim logout with an injected `id_token_hint` in Keycloak 26.8.2. - **[security]** `CVE-2026-96457` group-admin top-level move authorization - `CVE-2026-96457` fixes a group-admin DENY bypass through a top-level move in Keycloak 26.8.2. - **[security]** `CVE-2026-109081` realm `default-roles` injection - `CVE-2026-109081` fixes role injection into the realm `default-roles` by a principal with only create-client permission in Keycloak 26.8.2. ## Check if affected - **[security · critical]** `CVE-2026-117691` SAML redirect binding signatures - Applies if you use `SAML redirect binding`. - `CVE-2026-117691` fixes a SAML redirect binding signature bypass involving a percent-encoded parameter name in Keycloak 26.8.2. - **[security · high]** `CVE-2026-112208` Organization identity-first login - Applies if you use `Organization identity-first login`. - `CVE-2026-112208` fixes account takeover through a stale `SSO_AUTH` note during Organization identity-first login in Keycloak 26.8.2. - **[security · high]** `CVE-2026-110932` theme gzip cache disk exhaustion - Applies if you depend on `Keycloak <= 26.8.0`. - `CVE-2026-110932` fixes unauthenticated persistent disk exhaustion caused by the theme gzip cache in Keycloak 26.8.2. - **[security · high]** `CVE-2026-107123` Keycloak SAML endpoint - Applies if you expose a `SAML endpoint`. - `CVE-2026-107123` fixes an unauthenticated denial-of-service issue in the Keycloak SAML endpoint in Keycloak 26.8.2. - **[security · high]** `CVE-2026-107602` SAML 1.1 KeyInfo parser loop - Applies if you use `SAML 1.1`. - `CVE-2026-107602` fixes the SAML 1.1 KeyInfo parser loop that could exhaust CPU and the worker pool in Keycloak 26.8.2. - **[security · high]** `CVE-2026-110931` SAML 1.1 AuthorityBinding parser loop - Applies if you use `SAML 1.1`. - `CVE-2026-110931` fixes the SAML 1.1 AuthorityBinding parser loop that could terminate the JVM with an `OutOfMemoryError` in Keycloak 26.8.2. - **[security · high]** `CVE-2026-114232` UMA `resourceType` validation - Applies if you use `UMA`. - `CVE-2026-114232` fixes validation of the `resourceType` field in UMA user-managed permissions in Keycloak 26.8.2. - **[security · high]** `CVE-2026-93998` SAML adapter issuer validation - Applies if you use `SAML adapter`. - `CVE-2026-93998` fixes SAML adapter acceptance of assertions from the wrong configured issuer in Keycloak 26.8.2. - **[security · high]** `CVE-2026-96453` `kcadm` custom truststores - Applies if you use `kcadm`. - `CVE-2026-96453` fixes `kcadm` custom truststores accepting arbitrary self-signed certificates in Keycloak 26.8.2. - **[security · high]** `CVE-2026-92857` DCR reserved claim handling - Applies if you use `DCR`. - `CVE-2026-92857` fixes a default-allowed DCR protocol mapper that could write the reserved `sub` and `aud` claims in Keycloak 26.8.2. - **[security · high]** `CVE-2026-97175` IdP email auto-linking - Applies if you use `IdP email auto-linking`. - `CVE-2026-97175` fixes unverified IdP email auto-linking that could enable account takeover in Keycloak 26.8.2. - **[security · high]** `CVE-2026-82965` SAML SOAP endpoint parsing - Applies if you expose a `SAML SOAP endpoint`. - `CVE-2026-82965` fixes unbounded XML parsing in the SAML SOAP endpoint in Keycloak 26.8.2. - **[security · high]** `CVE-2026-92855` SAML Broker Holder-of-Key assertions - Applies if you use `SAML Broker`. - `CVE-2026-92855` fixes the SAML Broker acceptance of Holder-of-Key assertions without proof of key possession in Keycloak 26.8.2. - **[security · high]** `CVE-2026-97848` protocol mapper JSON handling - Applies if you use `Protocol mapper` and configure `jsonType=JSON`. - `CVE-2026-97848` fixes a protocol mapper configured with `jsonType=JSON` that could bypass the `CVE-2026-16102` fix in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-105305` Device Authorization Grant enforcement - Applies if you use `Device Authorization Grant`. - `CVE-2026-105305` fixes enforcement of the per-client `minimum.acr.value` requirement in the Device Authorization Grant in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-107623` OIDC DCR offline token revocation - Applies if you use `OIDC DCR`. - `CVE-2026-107623` fixes the OIDC DCR read-modify-write behavior that could silently disable offline token revocation during backchannel logout in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-97174` CIBA `sub` parameter handling - Applies if you use `CIBA`. - `CVE-2026-97174` fixes `sub` parameter injection in CIBA that could cause attacker authentication to issue victim tokens in Keycloak 26.8.2. - **[security · medium]** `CVE-2026-96448` FGAP v2 composite role mapping - Applies if you enable `FGAP v2`. - `CVE-2026-96448` fixes FGAP v2 composite-blind role mapping that allowed `manage-users` to assign a wrapper containing `realm-admin` in Keycloak 26.8.2. - **[security]** `CVE-2026-112201` MySQL and MariaDB login-failure upserts - Applies if you depend on `MySQL` or `MariaDB`. - `CVE-2026-112201` fixes login-failure upsert handling that trusted the affected-row count returned by MySQL or MariaDB in Keycloak 26.8.2. - **[security]** `CVE-2026-97367` DCR claim substitution - Applies if you use `DCR`. - `CVE-2026-97367` fixes DCR `azp` and `sid` claim substitution through User Property mappers in the Account REST session flow in Keycloak 26.8.2. - **[security]** `CVE-2026-96547` DCR registration-time claim paths - Applies if you use `DCR`. - `CVE-2026-96547` fixes the DCR registration-time claim-path gap that allowed attribute mappers to forge `realm_access.roles` from user-editable fields in Keycloak 26.8.2. - **[security]** `CVE-2026-96460` token exchange expiration - Applies if you use `token exchange`. - `CVE-2026-96460` fixes token exchange behavior that could produce tokens with unlimited expiration in Keycloak 26.8.2. - **[security]** `CVE-2026-96447` stateless token identity rebinding - Applies if you use `Stateless token`. - `CVE-2026-96447` fixes the `preferred_username` fallback for stateless tokens after client recreation in Keycloak 26.8.2. - **[security]** `CVE-2026-92856` SAML Identity Broker `ProxyRestriction` - Applies if you use `SAML Identity Broker`. - `CVE-2026-92856` fixes the SAML Identity Broker handling of `ProxyRestriction` and forbidden downstream assertion issuance in Keycloak 26.8.2. - **[security]** `CVE-2026-19688` Admin API audience check - Applies if you expose the `Admin API`. - `CVE-2026-19688` adds the missing audience check to the Admin API in Keycloak 26.8.2. - **[security]** SAML SLO issuer validation - Applies if you use `SAML SLO`. - Keycloak 26.8.2 fixes SAML SLO handling that allowed an unsigned client to impersonate a victim service provider through a spoofed issuer. - **[security]** Organization domain gate email verification - Applies if you configure an `organization domain gate`. - Keycloak 26.8.2 fixes handling of unverified broker email when satisfying an organization domain gate. ## Other recorded changes - 18 (defect_corrected 17, value_changed 1) [Full analysis](https://ratatosk.io/en/releases/keycloak/26.8.2) [Original release notes](https://github.com/keycloak/keycloak/releases/tag/26.8.2)