Keycloak 26.8.1 released

October 13 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

• #50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering
• #51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc
• #52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering
• #53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions
• #53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions
• #53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication
• #53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api
• #53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services
• #53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services
• #53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc
• #53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication
• #53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions
• #53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication
• #53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api
• #53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard
• #53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability
• #53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies
• #53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies
• #53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication
• #53582 Multiple CVEs in simple-git dependencies
• #53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui
• #53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api

Weaknesses

• #49009 DockerEndpoint does not validate invalidRequestMessage after parsing authorization request oidc
• #49786 Organizations: Invitation link can be used by multiple users due to missing single-use check organizations
• #51312 refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation oidc
• #51887 Username enumeration via empty-password timing authentication
• #52063 Ensure max consumed respone size is respected for OCSP and CRLs authentication
• #52680 Kerberos TRACE logging records complete SPNEGO credentials authentication
• #52982 Non-critical X.509 KeyUsage mismatch bypasses authentication policy authentication
• #52984 SimpleHttpResponse connection pool leak in identity brokering flows identity-brokering
• #53079 Dynamic client registration self-enables privileged SSF event access oidc
• #53116 SAML SLO: unauthenticated arbitrary session termination via LogoutRequest (SessionIndex) saml
• #53354 SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering
• #53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions
• #53430 Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener) storage
• #53494 SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check core
• #53693 FGAP v2: non-imported LDAP users returned in search results for query-users-only delegated admins admin/fine-grained-permissions

Bugs

• #51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api
• #52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange
• #52362 HttpServerUtil.sendResponse drops the headers it is given core
• #52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations
• #52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication
• #52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication
• #53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange
• #53142 Realm settings - security defenses admin/ui
• #53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui
• #53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for navigation ci
• #53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering
• #53505 Broken link to FIPS documentation docs
• #53567 Broken link to vault documentation in downstream docs
• #53569 Fix broken link to migrating the database in downstream docs
• #53571 Broken link in Operator Guide docs
• #53624 Multiple link issues including incorrect names and upstream only coding docs
• #53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action menu' fails on Firefox with strict mode violation admin/ui
• #53660 Flaky test: main.spec.ts 'Enable/disable help mode in desktop mode' fails with help label still visible admin/ui
• #53665 Flaky test: PauseTest.testPause times out on slow runners — no wait for operator readiness ci
• #53757 Broken EntityManager API link fails ExternalLinksTest testsuite
• #53824 JGroups certificate reload blocks the view handling thread and hides task failures infinispan
• #53825 JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled infinispan
• #53856 JsonFileImport198MigrationTest fails: realm certificate expired on 2026-10-12 ci