Security26.7.4
Keycloak 26.7.4 Security and Bug Fixes
This release addresses six security vulnerabilities including CVE fixes for replay gate acceptance, denial of service, privilege escalation, and SAML issues, plus performance improvements and bug fixes in Quarkus, caching, and the admin console.
Upgrading
Before upgrading refer to the migration guide for a complete list of changes.
All resolved issues
Security fixes
- #52834 [CVE-2026-90997] Default MySQL/MariaDB row counts make stateless replay gates accept reused artifacts
- #52835 [CVE-2026-79651] Keycloak Unauthenticated Denial of Service via Unbounded Locale Caching
- #52836 [CVE-2026-74909] Incomplete fix: percent-encoded semicolon bypasses matrix parameter stripping in PathMatcher
- #52837 [CVE-2026-19607] Username Takeover Leading to Account Lockout
- #52838 [CVE-2026-17526] Privilege escalation: the "impersonation" role can impersonate a realm administrator
- #52839 [CVE-2026-18212] SAML Redirect DEFLATE helpers leak native zlib state
Enhancements
- #52354 Upgrade to Quarkus 3.33.3.2
dist/quarkus
Bugs
- #49635 Performance issue with 26.6.2
dist/quarkus - #51102 Flaky test: org.keycloak.testsuite.oauth.AccessTokenTest#accessTokenRequest
ci - #52015 New links errors for https://quarkus.io/guides
docs - #52172 Cached `RealmAdapter.isUserManagedAccessAllowed()` returns `isEnabled()`
infinispan - #52173 `realm_client` is computed into a client's attributes and then persisted on save
admin/api - #52233 Oracle 19 full client OCI driver crashes on startup since 26.6.0 — SQLFeatureNotSupportedException on setNetworkTimeout
dist/quarkus - #52241 Clicking on a sub group in the admin console throws an exception
admin/ui - #52283 Flaky test SessionRestServiceTest.testGetDevicesSessions
testsuite - #52430 Flaky test: userprofile.spec.ts fails with timeout on "no-users-found-empty-action" in serial suite
testsuite
securitybug-fixesquarkusperformanceadmin-console
Source: original entry ↗