Keycloak: 26.8.2 released, November 5, 2026

#53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations

#53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication

#53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc

#53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication

#54333 [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder dist/quarkus

#54687 [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count

#54688 [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1)

#54689 [CVE-2026-110932] Keycloak <= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache)

#54690 [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint

#54691 [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint

#54692 [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName

#54693 [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307

#54694 [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313

#54695 [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289

#54696 [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306

#54697 [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292

#54698 [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields

#54699 [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression)

#54700 [CVE-2026-96460] Token from token exchange can have unlimited expiration

#54701 [CVE-2026-97848] [SECURITY] Protocol mapper with jsonType=JSON bypasses CVE-2026-16102 fix — duplicate resource_access claim in access token; forged resource_access in ID token, userinfo and introspection response

#54702 [CVE-2026-109081] Principal with only create-client can inject a role into the realm default-roles — #YWH-PGM40475-290

#54703 [CVE-2026-93998] SAML adapter accepts assertions from the wrong configured issuer

#54704 [CVE-2026-96453] kcadm custom truststores trust arbitrary self-signed certificates

#54705 [CVE-2026-92857] Identity spoofing: a default-allowed DCR protocol mapper writes the reserved sub and aud claims

#54706 [CVE-2026-103112] Account Takeover via Authentication Race

#54707 [CVE-2026-97175] Unverified IdP email auto-linking enables account takeover

#54708 [CVE-2026-96447] Stateless token preferred_username fallback enables identity rebinding after client recreation

#54709 [CVE-2026-82965] SAML SOAP endpoint DoS via unbounded XML parsing on /realms/{realm}/protocol/saml/resolve

#54710 [CVE-2026-96448] FGAP v2 composite-blind role mapping lets manage-users assign a wrapper containing realm-admin — #YWH-PGM40475-256

#54711 [CVE-2026-92855] Keycloak SAML Broker Accepts Holder-of-Key Assertions Without Proof of Key Possession

#54712 [CVE-2026-92856] Keycloak SAML Identity Broker Ignores `ProxyRestriction`, Allowing Forbidden Downstream Assertion Issuance

#54713 [CVE-2026-19688] Admin API missing audience check

#54714 [CVE-2026-117691] SAML redirect binding signature bypass via percent-encoded parameter name (%53AMLResponse) — broker login as any user

#50917 Realm client-session stats disclose hidden clients under FGAP v2 admin/fine-grained-permissions

#52104 JWE key-management algorithm not validated against provisioned key algorithm on request object decryption oidc

#53210 Harden PathMatcher URI normalization for leading dot segments and authority-less schemes authorization-services

#53535 SAML SLO: unsigned client can impersonate victim SP via spoofed Issuer on back-channel SessionIndex logout saml

#53815 Unverified broker email can satisfy an organization domain gate identity-brokering

#54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus

#44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication

#51630 FGAP V2: isInternal denylist missing admin-permissions client allows delegated admin to update it admin/fine-grained-permissions

#52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export

#52968 Much open UDP Sockets after some Time core

#53238 Theme resources intermittently 404 on a cold gzip cache: `GzipResourceEncodingProvider` replaces the cached file non-atomically core

#53507 Enhancement request suggestion in downstream documentation docs

#53510 Github discussion reference should only be upstream docs

#53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core

#53634 IdentityBrokerService fires duplicate error events and reflects user input in responses identity-brokering

#53760 Concurreny issue in JAXPValidationUtil saml

#53804 Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN operator

#53809 ISPN000427 timeout on distributed caches when entry lock is contended during topology change infinispan

#53819 Links to keycloak.org in downstream docs

#53834 Flaky test: Admin UI E2E "should handle OID4VC section visibility based on feature flag" admin/ui

#53898 Original exception is swallowed by NullPointerException when acquiring the database lock fails storage

#53901 NullPointerException in KeycloakLogFilter after failed startup as the Profile is no longer initialized dist/quarkus

#53930 Periodic user storage sync runs at twice the configured period when a sync takes longer than ~1 second core

#53999 Validate keycloak locale before setting to KEYCLOAK_LOCALE Cookie authentication

#54173 Upgrade playwright for JS tests testsuite

#54398 FIPS tests failing: Could not transfer artifact / Could not generate keypair for algorithm: X25519MLKEM768 ci