Keycloak 26.8.1 released

#50945 [CVE-2026-15943] OIDC identity provider update reuses masked client secret after token URL changes identity-brokering

#51381 [CVE-2026-18569] OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled oidc

#52321 [CVE-2026-82968] Persistent wrong-account linking through null / GitHub identity provider identity-brokering

#53057 [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission admin/fine-grained-permissions

#53060 [CVE-2026-94000] A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role admin/fine-grained-permissions

#53070 [CVE-2026-94218] 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254 authentication

#53071 [CVE-2026-94215] Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession admin/api

#53072 [CVE-2026-94213] Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978 authorization-services

#53073 [CVE-2026-94217] UMA scope merge across resource owners via name collision in resolveResourcePermission authorization-services

#53111 [CVE-2026-96446] Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none oidc

#53112 [CVE-2026-96445] Conditional OTP trusts skip headers on untrusted proxy paths authentication

#53158 [CVE-2026-97177] Generic user update bypasses denied reset-password permission admin/fine-grained-permissions

#53159 [CVE-2026-95503] Potential KDC spoofing attack when Kerberos password authentication is enabled authentication

#53160 [CVE-2026-97311] Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening) admin/api

#53187 [CVE-2026-97846] Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied token-exchange/standard

#53338 [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint observability

#53388 CVE-2026-91777 com.fasterxml.jackson.core:jackson-databind dependencies

#53393 Multiple CVEs in tools.jackson.core:jackson-databind dependencies

#53419 [CVE-2026-103884] Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf authentication

#53582 Multiple CVEs in simple-git dependencies

#53659 Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read admin/ui

#53674 [CVE-2026-107121] SMTP starttls=true permits plaintext credential and message downgrade admin/api

#49009 DockerEndpoint does not validate invalidRequestMessage after parsing authorization request oidc

#49786 Organizations: Invitation link can be used by multiple users due to missing single-use check organizations

#51312 refresh-vs-revoke race in strict mode (revokeRefreshToken=true) defeats token revocation oidc

#51887 Username enumeration via empty-password timing authentication

#52063 Ensure max consumed respone size is respected for OCSP and CRLs authentication

#52680 Kerberos TRACE logging records complete SPNEGO credentials authentication

#52982 Non-critical X.509 KeyUsage mismatch bypasses authentication policy authentication

#52984 SimpleHttpResponse connection pool leak in identity brokering flows identity-brokering

#53079 Dynamic client registration self-enables privileged SSF event access oidc

#53116 SAML SLO: unauthenticated arbitrary session termination via LogoutRequest (SessionIndex) saml

#53354 SAML broker HTTP-Redirect binding: query-string signature is verified over a different SAMLResponse than the one processed (';' parameter separator) - unauthenticated login as an arbitrary user (ANT-2026-HQ54RPF9) identity-brokering

#53417 FGAP v2 custom role injection via oidc-hardcoded-role-mapper bypasses removeTransientAdminRoles (incomplete fix for CVE-2026-4629) admin/fine-grained-permissions

#53430 Rotated-out client JWKS key and CRL stays valid on all but one node (keys cache invalidation event has no listener) storage

#53494 SimpleHttpResponse: connection pool leak on invalid charset and case-sensitive Content-Encoding check core

#53693 FGAP v2: non-imported LDAP users returned in results for query-users-only delegated admins admin/fine-grained-permissions

#51268 Group members endpoint sometimes returns 200 and empty list instead of 500 when DB is down admin/api

#52139 Client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0, causing orphaned OFFLINE_CLIENT_SESSION rows token-exchange

#52362 HttpServerUtil.sendResponse drops the headers it is given core

#52449 Organization invite: link in the plain-text part of the email is HTML-escaped and unusable organizations

#52792 Authenticator Reference is incorrectly masked after CVE-2026-16104 fix authentication

#52927 Admin Console "Sign out" on one user session unexpectedly logs out a different, unrelated session for the same user authentication

#53029 Token introspection omits act claim for token-exchange delegation tokens token-exchange

#53142 Realm settings - security defenses admin/ui

#53370 RoleSelect lost its undefined guard on form values, so Permissions → Evaluation crashes when Roles is selected admin/ui

#53467 Flaky Admin UI E2E: 'should add OIDC mapper of type Attribute Importer' times out waiting for ci

#53471 Regression with Trust Email when the userinfo endpoint is used identity-brokering

#53505 Broken link to FIPS documentation docs

#53567 Broken link to vault documentation in downstream docs

#53569 Fix broken link to migrating the database in downstream docs

#53571 Broken link in Operator Guide docs

#53624 Multiple link issues including incorrect names and upstream only coding docs

#53653 Flaky test: Admin UI E2E flows.spec.ts 'sets as default in action ' fails on Firefox with strict mode violation admin/ui

#53660 Flaky test: main.spec.ts 'Enable/disable help mode in desktop mode' fails with help label still visible admin/ui

#53665 Flaky test: PauseTest.testPause times out on slow runners — no wait for operator readiness ci

#53757 Broken EntityManager API link fails ExternalLinksTest testsuite

#53824 JGroups certificate reload blocks the view handling thread and hides task failures infinispan

#53825 JGroups TCP sends to healthy nodes are blocked by an unreachable node when virtual threads are disabled infinispan

#53856 JsonFileImport198MigrationTest fails: realm certificate expired on 2026-10-12 ci