Keycloak 26.6.1
This release addresses two critical security vulnerabilities including a blind SSRF via HTTP redirect handling and user enumeration via identity-first login. It also includes bug fixes for session token handling, admin client installation issues, and various other stability improvements.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #47276 CVE-2026-4366 Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling
core - #47619 CVE-2026-4633 Keycloak user enumeration via identity-first login
core
Enhancements
Bugs
- #47435 AuroraDB IT CI workflow not cleaning up databases
testsuite - #47737 deploy-testsuite profile is incomplete, causing discrete testsuite execution to fail
testsuite - #47776 False session type of access token in offline_access refresh token flow with scope parameter without offline_access scope
oidc - #47827 az vm create fails with JSON parsing error
ci - #47872 v26.6.0 Operator flood logs with warnings
operator - #47889 Not possible to sync latest keycloak-admin-client to keycloak-client
admin/client-java - #47904 @keycloak/keycloak-admin-client fails to install in version 26.6.0
admin/client-js - #47905 invalid package reference in keycloak-admin-ui
admin/ui - #47908 MigrateTo26_6_0 modifies custom browser flows, breaking existing realm authentication
organizations - #47929 User profile multiselect options not highlighted as selected in dropdown
admin/ui - #47955 IdentityProviderAuthenticator creates an infinite redirect loop when an IdP returns an error (e.g. access_denied) and the login was initiated with kc_idp_hint
identity-brokering - #48015 Missing explicit docs anchor for organizations
docs - #48032 Endpoint Response Text during Bootstrap contains Typo: Boostrap
dist/quarkus
Source: original entry ↗
More from Keycloak
Follow Keycloak to get its new changes in your feed and email digest.
Keycloak 26.8.1
Keycloak 26.8.1 includes critical security fixes addressing multiple CVEs across OIDC identity providers, fine-grained admin permissions, authentication mechanisms, and authorization services. This release resolves 18 security vulnerabilities, 10 weaknesses, and numerous bug fixes affecting token handling, admin APIs, and UI functionality.
Keycloak 26.8.0 Release
Keycloak version 26.8.0 has been released with updates and improvements to the authentication and identity platform.