26.6.4 Release
Keycloak 26.6.4 addresses eight critical security vulnerabilities including privilege escalation, authentication bypass, cross-site scripting, and authorization bypass issues. The release also upgrades to Quarkus 3.33.2.1 and fixes several bugs related to CI, migration documentation, and project build.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin
- #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
- #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
- #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
- #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
- #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
- #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison
- #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion
Enhancements
- #50100 Upgrade to Quarkus 3.33.2.1
Bugs
Source: original entry ↗
More from Keycloak
Follow Keycloak to get its new changes in your feed and email digest.
Keycloak 26.8.1
Keycloak 26.8.1 includes critical security fixes addressing multiple CVEs across OIDC identity providers, fine-grained admin permissions, authentication mechanisms, and authorization services. This release resolves 18 security vulnerabilities, 10 weaknesses, and numerous bug fixes affecting token handling, admin APIs, and UI functionality.
Keycloak 26.8.0 Release
Keycloak version 26.8.0 has been released with updates and improvements to the authentication and identity platform.