Catalog / Keycloak

26.8.1

todaysecurityaddedfixedOriginal notes

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
  • #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
  • #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
  • #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
  • #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
  • #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
  • #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
  • #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
  • #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
  • #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
  • #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
  • #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
  • #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
  • #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
  • #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
  • #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
  • #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
  • #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
  • #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
  • #53582 Multiple CVEs in simple-git dependencies
  • #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
  • #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api

Weaknesses

  • #49009 DockerEndpoint does not validate invalidRequestMessage after parsing authorization request oidc
  • #49786 Organizations: Invitation link can be used by multiple users due to missing single-use check organizations
  • #51312 refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation oidc
  • #51887 Username enumeration via empty-password timing authentication
  • #52063 Ensure max consumed respone size is respected for OCSP and CRLs authentication
  • #52680 Kerberos TRACE logging records complete SPNEGO credentials authentication
  • #52982 Non-critical X.509 KeyUsage mismatch bypasses authentication policy authentication
  • #52984 SimpleHttpResponse connection pool leak in identity brokering flows identity-brokering
  • #53079 Dynamic client registration self-enables privileged SSF event access oidc
  • #53116 SAML SLO: unauthenticated arbitrary session termination via LogoutRequest (SessionIndex) saml
  • #53354 SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering
  • #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
  • #53430 Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener) storage
  • #53494 SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check core
  • #53693 FGAP v2: non-imported LDAP users returned in search results for query-users-only delegated admins admin/fine-grained-permissions

Bugs

  • #51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
  • #52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
  • #52362 HttpServerUtil.sendResponse drops the headers it is given core
  • #52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
  • #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
  • #52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
  • #53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
  • #53142 Realm settings - security defenses admin/ui
  • #53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
  • #53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
  • #53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
  • #53505 Broken link to FIPS documentation docs
  • #53567 Broken link to vault documentation in downstream docs
  • #53569 Fix broken link to migrating the database in downstream docs
  • #53571 Broken link in Operator Guide docs
  • #53624 Multiple link issues including incorrect names and upstream only coding docs
  • #53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
  • #53660 Flaky test: main.spec.ts 'Enable/disable help mode in desktop mode' fails with help label still visible admin/ui
  • #53665 Flaky test: PauseTest.testPause times out on slow runners — no wait for operator readiness ci
  • #53757 Broken EntityManager API link fails ExternalLinksTest testsuite
  • #53824 JGroups certificate reload blocks the view handling thread and hides task failures infinispan
  • #53825 JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled infinispan
  • #53856 JsonFileImport198MigrationTest fails: realm certificate expired on 2026-10-12 ci