Keycloak 26.8.2 released

November 05 2026

To download the release go to Keycloak downloads.

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

• #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
• #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
• #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
• #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
• #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus
• #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count
• #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)
• #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)
• #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint
• #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint
• #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName
• #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307
• #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313
• #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289
• #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306
• #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292
• #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields
• #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)
• #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration
• #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response
• #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290
• #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer
• #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates
• #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims
• #54706 [CVE-2026-103112] Account Takeover via Authentication Race
• #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover
• #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation
• #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve
• #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256
• #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession
• #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance
• #54713 [CVE-2026-19688] Admin API missing audience check
• #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

Weaknesses

• #50917 Realm client-session stats disclose hidden clients under FGAP v2 admin/fine-grained-permissions
• #52104 JWE key-management algorithm not validated against provisioned key algorithm on request object decryption oidc
• #53210 Harden PathMatcher URI normalization for leading dot segments and authority-less schemes authorization-services
• #53535 SAML SLO: unsigned client can impersonate victim SP via spoofed Issuer on back-channel SessionIndex logout saml
• #53815 Unverified broker email can satisfy an organization domain gate identity-brokering

Enhancements

• #54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

Bugs

• #44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
• #51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions
• #52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
• #52968 Much open UDP Sockets after some Time core
• #53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core
• #53507 Enhancement request suggestion in downstream documentation docs
• #53510 Github discussion reference should only be upstream docs
• #53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core
• #53634 IdentityBrokerService fires duplicate error events and reflects user input in responses identity-brokering
• #53760 Concurreny issue in JAXPValidationUtil saml
• #53804 Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN operator
• #53809 ISPN000427 timeout on distributed caches when entry lock is contended during topology change infinispan
• #53819 Links to keycloak.org in downstream docs
• #53834 Flaky test: Admin UI E2E "should handle OID4VC section visibility based on feature flag" admin/ui
• #53898 Original exception is swallowed by NullPointerException when acquiring the database lock fails storage
• #53901 NullPointerException in KeycloakLogFilter after failed startup as the Profile is no longer initialized dist/quarkus
• #53930 Periodic user storage sync runs at twice the configured period when a sync takes longer than ~1 second core
• #53999 Validate keycloak locale before setting to KEYCLOAK_LOCALE Cookie authentication
• #54173 Upgrade playwright for JS tests testsuite
• #54398 FIPS tests failing: Could not transfer artifact / Could not generate keypair for algorithm: X25519MLKEM768 ci