Keycloak 26.5.3 released

February 10 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

• #46144 CVE-2026-1609 Disabled users can still obtain tokens via JWT Authorization Grant
• #46145 CVE-2026-1529 Forged invitation JWT enables cross-organization self-registration
• #46146 CVE-2026-1486 Logic Bypass in JWT Authorization Grant Allows Authentication via Disabled Identity Providers
• #46147 CVE-2025-14778 Incorrect ownership checks in /uma-policy/

Enhancements

• #45892 Upgrade minikube for CI tests operator

Bugs

• #44379 Node.js admin client does not refresh tokens admin/client-js
• #45459 k8s multiple restart (oomkilled) in v26.5.0-0 during startup because of RAM dist/quarkus
• #45662 Increase in startup memory consumption in post 26.5 versions dist/quarkus
• #45677 Hibernate Validator is enabled by default when not used dist/quarkus
• #45708 Unpexted value '' in mixed-cluster-compatibility-tests testsuite
• #45745 mixed-cluster-compatibility-tests fail due to incorrectly masked content in 26.5 branch ci
• #45755 Broken YAML indentation in operator rolling updates doc docs
• #45780 Remove fatal log messages from `ConsistentHash`