8000 Release 26.8.2 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

26.8.2

Latest
Latest

Choose a tag to compare

View all tags
@keycloak-bot keycloak-bot released this 05 Nov 16:00
· 419 commits to main since this release
26.8.2
e514445

Upgrading

Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

  • #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
  • #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
  • #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
  • #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
  • #54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus
  • #54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count
  • #54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)
  • #54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)
  • #54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint
  • #54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint
  • #54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName
  • #54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307
  • #54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313
  • #54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289
  • #54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306
  • #54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292
  • #54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields
  • #54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)
  • #54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration
  • #54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response
  • #54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290
  • #54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer
  • #54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates
  • #54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims
  • #54706 [CVE-2026-103112] Account Takeover via Authentication Race
  • #54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover
  • #54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation
  • #54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve
  • #54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256
  • #54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession
  • #54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance
  • #54713 [CVE-2026-19688] Admin API missing audience check
  • #54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

Weaknesses

  • #50917 Realm client-session stats disclose hidden clients under FGAP v2 admin/fine-grained-permissions
  • #52104 JWE key-management algorithm not validated against provisioned key algorithm on request object decryption oidc
  • #53210 Harden PathMatcher URI normalization for leading dot segments and authority-less schemes authorization-services
  • #53535 SAML SLO: unsigned client can impersonate victim SP via spoofed Issuer on back-channel SessionIndex logout saml
  • #53815 Unverified broker email can satisfy an organization domain gate identity-brokering

Enhancements

  • #54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

Bugs

  • #44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
  • #51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions
  • #52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
  • #52968 Much open UDP Sockets after some Time core
  • #53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core
  • #53507 Enhancement request suggestion in downstream documentation docs
  • #53510 Github discussion reference should only be upstream docs
  • #53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core
  • #53634 IdentityBrokerService fires duplicate error events and reflects user input in responses identity-brokering
  • #53760 Concurreny issue in JAXPValidationUtil saml
  • #53804 Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN operator
  • #53809 ISPN000427 timeout on distributed caches when entry lock is contended during topology change infinispan
  • #53819 Links to keycloak.org in downstream docs
  • #53834 Flaky test: Admin UI E2E "should handle OID4VC section visibility based on feature flag" admin/ui
  • #53898 Original exception is swallowed by NullPointerException when acquiring the database lock fails storage
  • #53901 NullPointerException in KeycloakLogFilter after failed startup as the Profile is no longer initialized dist/quarkus
  • #53930 Periodic user storage sync runs at twice the configured period when a sync takes longer than ~1 second core
  • #53999 Validate keycloak locale before setting to KEYCLOAK_LOCALE Cookie authentication
  • #54173 Upgrade playwright for JS tests testsuite
  • #54398 FIPS tests failing: Could not transfer artifact / Could not generate keypair for algorithm: X25519MLKEM768 ci
Assets 23
Loading
0