Keycloak 26.6.3 released

June 04 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

• #47707 CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names account/ui
• #47935 [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc
• #48036 [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services
• #48709 [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api
• #48805 CVE-2026-42581 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
• #49118 [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc
• #49133 [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn
• #49174 [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions
• #49175 [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering
• #49426 [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc
• #49428 [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml
• #49431 [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations
• #49433 [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api
• #49434 [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap
• #49435 [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc
• #49436 [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc

Weaknesses

• #48978 UNSAFE_PATH_PATTERN regex to cover percent-encoded terminators and control characters oidc
• #48986 Authorization Services: NullPointerException in UMA permission grant when stale permission ticket references removed scope authorization-services
• #48987 Account API: Resource sharing endpoints ignore userManagedAccessAllowed realm setting authorization-services
• #49086 Account resource sharing resolves recipient by username before email, granting access to wrong user authorization-services

Enhancements

• #48311 Upgrade to Quarkus 3.33.2 dist/quarkus
• #48695 Add startup check for missing database indexes
• #49148 Add SPI option to disable FD_SOCK2 failure detection
• #49526 Update to simple-git 3.36.0
• #49530 Update to uuid >=13.0.1

Bugs

• #45957 Handling of CORS requests in the Admin UI ineffective / open for CSRF admin/ui
• #47036 Account ResourceService user endpoint returns excessive user data in UMA-enabled realms core
• #48324 UMA IS_ADMIN filter breaks ticket finding authorization-services
• #48430 Wildcard redirect URI matching does not enforce host boundary when * is placed directly after hostname oidc
• #48432 ClientAdapter using wrong value for isFrontChannelLogout oidc
• #48438 Keycloak 26.6.0/26.6.1 exits (code 1) ~100ms after async realm migration completes; migrations not persisted core
• #48455 ContextNotActiveException during error handling core
• #48464 Incomplete SCIM schema definition for objects scim
• #48529 Broken downstream docs formatting on Kubernetes topic docs
• #48584 Updating Keycloak to 26.6.x fails on SQL Server with case sensitive collation core
• #48628 Client registerNode and unregisterNode endpoints fail authenticating the client core
• #48681 ExternalLinksTest: oasis-open.org/standard/saml/ returns 403 in CI causing flaky documentation check ci
• #48716 Missing index IDX_IDP_FOR_LOGIN and IDX_CLIENT_ATT_BY_NAME_VALUE for Microsoft SQL Server core
• #48744 Input validation/ Unhandled NullPointerException on alg:none JWT in Bearer Authentication authentication
• #48792 Virtual Thread checking is not working infinispan
• #48806 NPE when accessing Account UI and the ACCOUNT feature is disabled account/api
• #48877 Keycloak 26.6.1 does not persist UPDATE_PASSWORD for LDAP/AD federated users after temporary password reset ldap
• #48904 Consistent 500 on DELETE of realms via non-browser clients calling REST API admin/api
• #49058 Keycloak fails to run tests with embedded undertow dist/quarkus
• #49140 Workflows documentation: offboarding example is incorrectly enclosing the list of revoked roles with double quotes workflows
• #49149 Disable single thread sender in JGroups infinispan
• #49151 FIPS jobs fail in CI because java-25-openjdk-devel package is missing testsuite
• #49163 Enable JGroups message stats infinispan
• #49194 Use Java 25 again for FIPS jobs testsuite
• #49222 Incorrect link to Themes documentation docs
• #49224 Broken links in UI Customization Guide docs
• #49263 Use the PostgreSQL driver privacy option `logServerErrorDetail` dist/quarkus
• #49265 Since Hibernate 7, the workaround to not log-and-throw Hibernate errors does not longer work dist/quarkus
• #49274 JavaScript CI hangs when installing playwright testsuite
• #49288 Link issue in the documentation for https://www.rfc-editor.org/rfc/rfc7662 docs
• #49356 SAML async processing leaves a dangling threadlocal transaction dist/quarkus
• #49611 Realm extensions require Bearer or Drop authorisation admin/api