Keycloak 24.0.5 released

June 04 2024

To download the release go to Keycloak downloads.


Security issue with PAR clients using client_secret_post based authentication

This release contains the fix of the important security issue affecting some OIDC confidential clients using PAR (Pushed authorization request). In case you use OIDC confidential clients together with PAR and you use client authentication based on client_id and client_secret sent as parameters in the HTTP request body (method client_secret_post specified in the OIDC specification), it is highly encouraged to rotate the client secrets of your clients after upgrading to this version.


Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues