Keycloak 26.5.2 released

January 23 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

#44994 CVE-2025-67735 - netty-codec-http: Request Smuggling via CRLF Injection dependencies

#43443 Keycloak should warn when ISPN or JGROUPS is running in debug level logging
#45498 Ignore OpenAPI artifacts when disabled dist/quarkus

#44785 Can not get through SSO login if using a custom attribute with default value user-profile
#45015 Deadlock in Infinispan virtual threads infinispan
#45250 IDToken contains duplicate address claims oidc
#45333 User admin events don't show role, group mapping, reset password like events admin/ui
#45396 Database Migration fails when updating to 26.5.0 on MS SQL core
#45415 cache-remote-host becomes mandatory at build time when using clusterless feature infinispan
#45417 Unmanaged Attributes Type (Only administrators can view) allows admin API to set Unmanaged Attributes user-profile
#45474 Admin REST API document is not up to date docs
#45526 Regression (26.5.1): Organizations domain resolution fails on MariaDB/MySQL due to ORG/ORG_DOMAIN collation mismatch organizations
#45533 Keycloak should not allow matrix parameters in URLs as we don't use them dist/quarkus
#45570 CVE-2025-66560 - io.quarkus/quarkus-rest: Quarkus REST Worker Thread Exhaustion Vulnerability
#45584 Keycloak supported specs should list DPoP as supported oidc
#45590 OIDCIdentityProviderConfig issuer configuration token-exchange
#45597 Possible mismatch of charset/collation between columns on mysql/mariadb organizations
#45651 CVE-2025-14559 keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users