Impact Score: 5/10
Keycloak 26.2.5 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: keycloak · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Keycloak 26.2.5. Source highlight: Before upgrading refer to
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
📄 View Raw Release Notes (Original Developer Log)
<div>
<h2>Upgrading</h2>
<p>Before upgrading refer to <a href="file:/home/runner/work/keycloak-rel/keycloak-rel/target/web/docs/latest/upgrading/#migration-changes">the migration guide</a> for a complete list of changes.</p>
<h2>All resolved issues</h2>
<h3>Enhancements</h3>
<ul>
<li><a href="https://github.com/keycloak/keycloak/issues/39469">#39469</a> Fix Securing Apps links to adapters <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39486">#39486</a> Email server credentials can be harvested through host/port manipulation <code>admin/api</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39541">#39541</a> Fix doc link to FGAP v1 <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39543">#39543</a> Apply edits to Operators Guide <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39572">#39572</a> Edit Observability Guide <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39590">#39590</a> Fix callouts in Operator guide <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39638">#39638</a> Sessions from Infinispan should be mapped lazily for the Admin UI </li>
<li><a href="https://github.com/keycloak/keycloak/issues/39651">#39651</a> Speed up Infinispan list of all sessions be more eagerly remove old client sessions </li>
<li><a href="https://github.com/keycloak/keycloak/issues/39665">#39665</a> When logging in, all client sessions are loaded which is slow <code>oidc</code></li>
</ul>
<h3>Bugs</h3>
<ul>
<li><a href="https://github.com/keycloak/keycloak/issues/39130">#39130</a> Authorization Code Flow Fails Scope Validation After Credential Definition Migration to Realm Level <code>oid4vc</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39157">#39157</a> [quarkus-next] TestEngine with ID 'junit-jupiter' failed to discover tests <code>dist/quarkus</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39264">#39264</a> [OID4VCI] Documentation Errors <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39358">#39358</a> Aggregated policy: Cannot select policies that do not appear in the drop-down list <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39450">#39450</a> quarkus runtime options are treated as buildtime options <code>dist/quarkus</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39496">#39496</a> [26.2.3/26.1.5] Regression: empty ClientList in UI for Custom UserStorageProvider <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39499">#39499</a> UI does not show user's attributes after reentering the Attributes TAB <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39502">#39502</a> Refreshed tokens are not persisted for IDP token exchange <code>token-exchange</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39509">#39509</a> UI does not show organization's attributes after reentering the Attributes TAB <code>account/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39538">#39538</a> Autocomplete in Mapper type of user federation broken <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39540">#39540</a> Forms IT tests breaks with Chrome 136.0.7103.59 <code>ci</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39612">#39612</a> Unable to change the OTP hash algorithm <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39614">#39614</a> Keycloak not using custom Infinispan config <code>infinispan</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39663">#39663</a> Duplicate validation message “Please specify username.” shown on login form <code>login/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39693">#39693</a> Clicking on the jump links removes the localization of the UI <code>admin/ui</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39697">#39697</a> Authorization documentation shows the wrong view <code>authorization-services</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39710">#39710</a> Recreate update is not scaling down the statefulset to zero <code>operator</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39724">#39724</a> Hibernate LazyInitializationException when deleting client with CompositeRoles <code>core</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39753">#39753</a> POST realm API returns 400 on conflict instead of 409 in version 26.2.4 <code>admin/api</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39798">#39798</a> Documentation has outdated link to the "latest" branch of quickstarts <code>docs</code></li>
<li><a href="https://github.com/keycloak/keycloak/issues/39800">#39800</a> [KEYCLOAK CI] - AuroraDB IT - Create EC2 runner instance <code>ci</code></li>
</ul>
</div>