Keycloak 26.3.0 — Release Notes & Engineering Impact

<div> <h2>Highlights</h2> <div class="paragraph"> <p>This release delivers advancements to optimize your system and improve the experience of users, developers and administrators:</p> </div> <div class="ulist"> <ul> <li> <p><strong>Account recovery</strong> with 2FA recovery codes, protecting users from lockout.</p> </li> <li> <p>Simplified experiences for application developers with <strong>streamlined WebAuthn/Passkey registration</strong> and <strong>simplified account linking</strong> to identity providers via application initiated actions.</p> </li> <li> <p>Broader connectivity with the ability to <strong>broker with any OAuth 2.0 compliant authorization server</strong>, and enhanced <strong>trusted email verification</strong> for OpenID Connect providers.</p> </li> <li> <p><strong>Asynchronous logging</strong> for higher throughput and lower latency, ensuring more efficient deployments.</p> </li> <li> <p>For administrators, <strong>experimental rolling updates for patch releases</strong> mean minimized downtime and smoother upgrades.</p> </li> </ul> </div> <div class="paragraph"> <p>Read on to learn more about each new feature, and <a href="https://www.keycloak.org/docs/latest/upgrading/index.html">find additional details in the upgrading guide</a> if you are upgrading from a previous release of Keycloak.</p> </div> <div class="sect2"> <h3 id="_recovering_your_account_if_you_lose_your_2fa_credentials">Recovering your account if you lose your 2FA credentials</h3> <div class="paragraph"> <p>When using for example a one-time-password (OTP) generators as a second factor for authenticating users (2FA), a user can get locked out of their account when they, for example, lose their phone that contains the OTP generator. To prepare for such a case, the recovery codes feature allows users to print a set of recovery codes as an additional second factor. If the recovery codes are then allowed as an alternative 2FA in the login flow, they can be used instead of the OTP generated passwords.</p> </div> <div class="paragraph"> <p>With this release, the recovery codes feature is promoted from preview to a supported feature. For newly created realms, the browser flow now includes the Recovery Authentication Code Form as <em>Disabled</em>, and it can be switched to <em>Alternative</em> by admins if they want to use this feature.</p> </div> <div class="paragraph"> <p>For more information about this 2FA method, see the <a href="https://www.keycloak.org/docs/26.3.0/server_admin/#_recovery-codes">Recovery Codes</a> chapter in the Server Administration Guide.</p> </div> </div> <div class="sect2"> <h3 id="_performance_improvements_to_import_export_and_migration">Performance improvements to import, export and migration</h3> <div class="paragraph"> <p>The time it takes to run imports, exports or migrations involving a large number of realms has been improved. There is no longer a cumulative performance degradation for each additional realm processed.</p> </div> </div> <div class="sect2"> <h3 id="_simplified_registration_for_webauthn_and_passkeys">Simplified registration for WebAuthn and Passkeys</h3> <div class="paragraph"> <p>Both WebAuthn Register actions (<code>webauthn-register</code> and <code>webauthn-register-passwordless</code>) which are also used for Passkeys now support a parameter <code>skip_if_exists</code> when initiated by the application (AIA).</p> </div> <div class="paragraph"> <p>This should make it more convenient to use the AIA in scenarios where a user has already set up WebAuthn or Passkeys. The parameter allows skipping the action if the user already has a credential of that type.</p> </div> <div class="paragraph"> <p>For more information, see the <a href="https://www.keycloak.org/docs/26.3.0/server_admin/#_webauthn_aia">Registering WebAuthn credentials using AIA</a> chapter in the Server Administration Guide.</p> </div> </div> <div class="sect2"> <h3 id="_simplified_linking_of_the_user_account_to_an_identity_provider">Simplified linking of the user account to an identity provider</h3> <div class="paragraph"> <p>Client-initiated linking a user account to the identity provider is now based on application-initiated action (AIA) implementation. This functionality aligns configuring this functionality and simplifies the error handling the calling of the client application, making it more useful for a broader audience.</p> </div> <div class="paragraph"> <p>The custom protocol, which was previously used for client-initiated account linking, is now deprecated.</p> </div> </div> <div class="sect2"> <h3 id="_brokering_with_oauth_v2_compliant_authorization_servers">Brokering with OAuth v2 compliant authorization servers</h3> <div class="paragraph"> <p>In previous releases Keycloak already supported federation with other OpenID Connect and SAML providers, as well as with several Social Providers like GitHub and Google which are based on OAuth 2.0.</p> </div> <div class="paragraph"> <p>The new OAuth 2.0 broker now closes the gap to federate with any OAuth 2.0 provider. This then allows you to federate, for example, with Amazon or other providers. As this is a generic provider, you will need to specify the different claims and a user info endpoint in the provider&#8217;s configuration.</p> </div> <div class="paragraph"> <p>For more information, see the <a href="https://www.keycloak.org/docs/26.3.0/server_admin/#_identity_broker_oauth">OAuth v2 identity providers</a> chapter in the Server Administration Guide.</p> </div> </div> <div class="sect2"> <h3 id="_trusted_email_verification_when_brokering_openid_connect_providers">Trusted email verification when brokering OpenID Connect Providers</h3> <div class="paragraph"> <p>Until now, the OpenID Connect broker did not support the standard <code>email_verified</code> claim available from the ID Tokens issued by OpenID Connect Providers.</p> </div> <div class="paragraph"> <p>Starting with this release, Keycloak supports this standard claim as defined by the <a href="https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims">OpenID Connect Core Specification</a> for federation.</p> </div> <div class="paragraph"> <p>Whenever users are federated for the first time or re-authenticating and if the <strong>Trust email</strong> setting is enabled, <strong>Sync Mode</strong> is set to <code>FORCE</code> and the provider sends the <code>email_verified</code> claim, the user account will have their email marked according to the <code>email_verified</code> claim. If the provider does not send the claim, it defaults to the original behavior and sets the email as verified.</p> </div> </div> <div class="sect2"> <h3 id="_asynchronous_logging_for_higher_throughput_and_lower_latency">Asynchronous logging for higher throughput and lower latency</h3> <div class="paragraph"> <p>All available log handlers now support asynchronous logging capabilities. Asynchronous logging helps deployments that require high throughput and low latency.</p> </div> <div class="paragraph"> <p>For more details on this opt-in feature, see the <a href="https://www.keycloak.org/server/logging">Logging guide</a>.</p> </div> </div> <div class="sect2"> <h3 id="_rolling_updates_for_patch_releases_for_minimized_downtime_preview">Rolling updates for patch releases for minimized downtime (preview)</h3> <div class="paragraph"> <p>In the previous release, the Keycloak Operator was enhanced to support performing rolling updates of the Keycloak image if both images contain the same version. This is useful, for example, when switching to an optimized image, changing a theme or a provider source code.</p> </div> <div class="paragraph"> <p>In this release, we extended this to perform rolling update when the new image contains a future patch release from the same <code>major.minor</code> release stream as a preview feature. This can reduce the service&#8217;s downtime even further, as downtime is only needed when upgrading from a different minor or major version.</p> </div> <div class="paragraph"> <p>Read more on how to enable this feature in <a href="https://www.keycloak.org/server/update-compatibility#rolling-updates-for-patch-releases">update compatibility command</a>.</p> </div> </div> <div class="sect2"> <h3 id="_passkeys_integrated_in_the_default_username_forms">Passkeys integrated in the default username forms</h3> <div class="paragraph"> <p>In this release Keycloak integrates <strong>Passkeys</strong> in the default authentications forms. A new switch <strong>Enable Passkeys</strong> is available in the configuration, <strong>Authentication</strong> → <strong>Policies</strong> → <strong>Webauthn Passwordless Policy</strong>, that seamlessly incorporates passkeys support to the realm. With just one click, Keycloak offers conditional and modal user interfaces in the default login forms to allow users to authenticate with a passkey.</p> </div> <div class="paragraph"> <p>The <strong>Passkeys</strong> feature is still in preview. Follow the <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a> guide to enable it.</p> </div> <div class="paragraph"> <p>For more information, see <a href="https://www.keycloak.org/docs/26.3.0/server_admin/#passkeys_server_administration_guide">Passkeys section in the Server Administration Guide</a>.</p> </div> </div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="file:/home/runner/work/keycloak-rel/keycloak-rel/target/web/docs/latest/upgrading/#migration-changes">the migration guide</a> for a complete list of changes.</p> <h2>All resolved issues</h2> <h3>New features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/21995">#21995</a> Configurable probes in the Operator <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/29116">#29116</a> Add supported config options for additional datasources <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/29596">#29596</a> Passkeys conditional UI: integration with username/password form <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38465">#38465</a> Name for OTP device should be unique <code>account/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38985">#38985</a> Possibility to log details and representation to the jboss-logging listener </li> <li><a href="https://github.com/keycloak/keycloak/issues/39408">#39408</a> make MaxAuthAge configurable for required actions <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40021">#40021</a> Passkeys conditional UI: integration with independent username and password form <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40033">#40033</a> Deprecate or remove the current conditionalUI authenticator <code>authentication/webauthn</code></li> </ul> <h3>Enhancements</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/12025">#12025</a> Get multiple users by Ids <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/21277">#21277</a> Support IPv6 only environments <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/23283">#23283</a> Allow Keycloak operator to parameterize the Service annotations and labels </li> <li><a href="https://github.com/keycloak/keycloak/issues/28713">#28713</a> Temporarily Locked out users change the enabled flag of the user <code>account/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/28851">#28851</a> Support Syslog async properties <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/30227">#30227</a> Admin-UI: move PKCE Code Challenge Method setting from Advanced to Settings tab </li> <li><a href="https://github.com/keycloak/keycloak/issues/33978">#33978</a> Migration progress missing </li> <li><a href="https://github.com/keycloak/keycloak/issues/34160">#34160</a> Remove CACHE_EMBEDDED_REMOTE_STORE Feature </li> <li><a href="https://github.com/keycloak/keycloak/issues/35446">#35446</a> Ensure Client Initiated Account Linking behaves like other Application Initiated Actions <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36635">#36635</a> Change User details page drop-down filter to make it easier to find the 'admin' role <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37532">#37532</a> Remove user event types from admin UI is unusable <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37716">#37716</a> Add ability for Quick Theme to import theme from a jar <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37717">#37717</a> Quick Theme should allow naming the jar before download <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38091">#38091</a> Add more validation for proxy-headers </li> <li><a href="https://github.com/keycloak/keycloak/issues/38228">#38228</a> Auto submit the "Organization Identity-First Login" form with pre-filled username field <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38259">#38259</a> Enhance mapping from env variables to wildcards </li> <li><a href="https://github.com/keycloak/keycloak/issues/38262">#38262</a> Add `count` endpoint for organizations <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38433">#38433</a> Make `ThemeManagerFactory` into a proper SPI so that it can be accessed/overridden <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38496">#38496</a> Create CacheRemoteConfigProvider </li> <li><a href="https://github.com/keycloak/keycloak/issues/38497">#38497</a> Create CacheEmbeddedConfigProvider </li> <li><a href="https://github.com/keycloak/keycloak/issues/38578">#38578</a> Support Asynchronous logging </li> <li><a href="https://github.com/keycloak/keycloak/issues/38614">#38614</a> Improve Dutch translation for Theme base/login and base/email <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38620">#38620</a> Key generation for client authentication is always RSA 2048 with a 10-year validity, regardless of the selected algorithm <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38621">#38621</a> Client secret generation provides lower than expected entropy <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38649">#38649</a> Improve migration performance <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38663">#38663</a> Access Token IDs have less than 128 bits of entropy <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38714">#38714</a> Add feedback when user sync process is triggered in user federation </li> <li><a href="https://github.com/keycloak/keycloak/issues/38863">#38863</a> Allow logging of slow database operations </li> <li><a href="https://github.com/keycloak/keycloak/issues/38882">#38882</a> Upgrade command rolling updates for patch releases / step 1: experimental </li> <li><a href="https://github.com/keycloak/keycloak/issues/38883">#38883</a> Upgrade command rolling updates for patch releases / step 2: preview </li> <li><a href="https://github.com/keycloak/keycloak/issues/38956">#38956</a> Clarify upgrade instructions </li> <li><a href="https://github.com/keycloak/keycloak/issues/38981">#38981</a> Allow setting locale when edit mode is `READ_ONLY` </li> <li><a href="https://github.com/keycloak/keycloak/issues/38994">#38994</a> Make recovery codes supported <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39057">#39057</a> Change the title for Grafana dashboards guide to plural <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39059">#39059</a> Document operator `Auto` update strategy when used with `podTemplate` </li> <li><a href="https://github.com/keycloak/keycloak/issues/39080">#39080</a> Standardize introductory text in Keycloak guides </li> <li><a href="https://github.com/keycloak/keycloak/issues/39136">#39136</a> Update LDAP configuration with a hint how to enable password hashing in ApacheDS </li> <li><a href="https://github.com/keycloak/keycloak/issues/39142">#39142</a> Make distribution startup timeout configurable <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39172">#39172</a> Add description to groups </li> <li><a href="https://github.com/keycloak/keycloak/issues/39191">#39191</a> Ability to skip AIA for adding WebAuthn security key in case that user already has one <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39198">#39198</a> Better tooltip for Strategy to increase wait time in brute force settings </li> <li><a href="https://github.com/keycloak/keycloak/issues/39213">#39213</a> Polishing recovery codes <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39214">#39214</a> Use required action configuration instead of password policy for warning threshold <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39243">#39243</a> Should we improve metadata of recovery code credential? <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39338">#39338</a> Keycloak Operator: TTL for KeycloakRealmImport jobs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39405">#39405</a> Message bundle hot reloading </li> <li><a href="https://github.com/keycloak/keycloak/issues/39418">#39418</a> Clarify when to use podman <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39469">#39469</a> Fix Securing Apps links to adapters <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39486">#39486</a> Email server credentials can be harvested through host/port manipulation <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39541">#39541</a> Fix doc link to FGAP v1 <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39543">#39543</a> Apply edits to Operators Guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39544">#39544</a> Change discovery in Kubernetes to `jdbc-ping` </li> <li><a href="https://github.com/keycloak/keycloak/issues/39545">#39545</a> JGroups: Switch to "per-destination" bundler for `jdbc-ping` </li> <li><a href="https://github.com/keycloak/keycloak/issues/39563">#39563</a> Protocol `openid-connect` should be selected as default for ClientScopes <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39572">#39572</a> Edit Observability Guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39587">#39587</a> Make slow SQL and SQL comment prefix configurable </li> <li><a href="https://github.com/keycloak/keycloak/issues/39590">#39590</a> Fix callouts in Operator guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39595">#39595</a> Build user representations when searching based on the user profile settings <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39617">#39617</a> OpenTelemetry Tracing: Spans as part of the "commit" should be nested <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39619">#39619</a> OpenTelementry Tracing: Show calls within a rest resource as nested <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39638">#39638</a> Sessions from Infinispan should be mapped lazily for the Admin UI </li> <li><a href="https://github.com/keycloak/keycloak/issues/39641">#39641</a> Return only manage permissions when listing users via administration console </li> <li><a href="https://github.com/keycloak/keycloak/issues/39651">#39651</a> Speed up Infinispan list of all sessions be more eagerly remove old client sessions </li> <li><a href="https://github.com/keycloak/keycloak/issues/39653">#39653</a> Pass notifications in batches to remote and local ISPN cache <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39665">#39665</a> When logging in, all client sessions are loaded which is slow <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39670">#39670</a> Add re-authentication when updating email via UPDATE_EMAIL feature </li> <li><a href="https://github.com/keycloak/keycloak/issues/39723">#39723</a> Redirect request from wrong version to the right version </li> <li><a href="https://github.com/keycloak/keycloak/issues/39748">#39748</a> Docs: server_admin/topics/clients/oidc/proc-using-a-service-account.adoc <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39761">#39761</a> Revise DPoP Codes - refactor retrieveDPoPHeaderIfPresent method <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39817">#39817</a> Document that a shell wrapper must not start replace PID 1 in containers </li> <li><a href="https://github.com/keycloak/keycloak/issues/39826">#39826</a> Revise DPoP Codes - refactor remove unused methods <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39855">#39855</a> Revise Client Policies Codes - AbstractClientPoliciesTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39872">#39872</a> Improve JGroups network bind address documetion </li> <li><a href="https://github.com/keycloak/keycloak/issues/39885">#39885</a> Identity provider with FORCE sync mode does not detect verified email change <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39889">#39889</a> Revise Client Policies Codes - ClientPoliciesAdminTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39891">#39891</a> Revise Client Policies Codes - ClientPoliciesConditionTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39909">#39909</a> Add missing id attributes for button elements of keycloak.v2 login theme </li> <li><a href="https://github.com/keycloak/keycloak/issues/39962">#39962</a> Create a POC of running 2 containers in the new testsuite </li> <li><a href="https://github.com/keycloak/keycloak/issues/39965">#39965</a> Create test cases for OIDC flows </li> <li><a href="https://github.com/keycloak/keycloak/issues/39975">#39975</a> Make the checkbox "Sign out from other devices" unchecked by default <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39980">#39980</a> Revise Client Policies Codes - ClientPoliciesExecutorTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39982">#39982</a> Revise Client Policies Codes - ClientPoliciesExtendedEventTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39987">#39987</a> Unnecessary boxing/unboxing to parse a primitive. SAST <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40012">#40012</a> Revise Client Policies Codes - ClientPoliciesLoadUpdateTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40014">#40014</a> Revise Client Policies Codes - ClientPoliciesTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40016">#40016</a> Revise Client Policies Codes - SecureRedirectUrisEnforcerExecutorTest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40022">#40022</a> Passkeys conditional UI: integration with the organization authenticator <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40023">#40023</a> Upgrade webauthn4j to a newer version <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40024">#40024</a> Throw an exception if transport mTLS keystore or Truststore does not exist </li> <li><a href="https://github.com/keycloak/keycloak/issues/40027">#40027</a> Unrelated Types. SAST </li> <li><a href="https://github.com/keycloak/keycloak/issues/40030">#40030</a> Potential thread safety Issue with lazy init of transformerFactory at TransformerUtil. SAST </li> <li><a href="https://github.com/keycloak/keycloak/issues/40034">#40034</a> Serialization issue in SAMLEntityAttributesParser - no void constructor in superclass. SAST </li> <li><a href="https://github.com/keycloak/keycloak/issues/40039">#40039</a> Abbreviate text in PKCE method configuration label in OIDC Client configuration <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40050">#40050</a> Revise Client Policies Codes - OAuth 2.1 tests <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40052">#40052</a> Revise Client Policies Codes - FAPI1Test <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40054">#40054</a> Revise Client Policies Codes - FAPI2Test <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40056">#40056</a> Revise Client Policies Codes - FAPICIBATest <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40060">#40060</a> Sign of a bad copy/paste in logging of usserSessionLimitsAuthenticator <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40108">#40108</a> Support more i18n keys for messages_ru.properties </li> <li><a href="https://github.com/keycloak/keycloak/issues/40129">#40129</a> Refactor the key value input so that it has an override for key and value component </li> <li><a href="https://github.com/keycloak/keycloak/issues/40165">#40165</a> Upgrade to Infinispan 15.0.15 </li> <li><a href="https://github.com/keycloak/keycloak/issues/40166">#40166</a> Upgrade Aurora PostgreSQL to a supported release </li> <li><a href="https://github.com/keycloak/keycloak/issues/40188">#40188</a> Document security implications of Keycloak CR <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40191">#40191</a> Icon for default role should have a separator to the role name <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40208">#40208</a> ServerInfo View in Admin-Console should show CPU information </li> <li><a href="https://github.com/keycloak/keycloak/issues/40233">#40233</a> Make `ProviderConfigurationBuilder` fail when a duplicate property is added. </li> <li><a href="https://github.com/keycloak/keycloak/issues/40336">#40336</a> Support all i18n keys for messages_ru.properties <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40419">#40419</a> Update links specs in OIDC guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40440">#40440</a> Add link to OIDC Discovery Spec in the documentation of the certs endpoint <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40441">#40441</a> Add templates for release notes and migration guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40446">#40446</a> Review Profile makes users prone to phishing attacks <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40448">#40448</a> add (ky )kyrgyz language support <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40472">#40472</a> Default to num_owners=2 when the persistent-user-sessions feature is disabled <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40487">#40487</a> Clarify OpenShift v4 Identity Provider instructions </li> <li><a href="https://github.com/keycloak/keycloak/issues/40489">#40489</a> When redirecting old resource versions, keep query parameters </li> <li><a href="https://github.com/keycloak/keycloak/issues/40533">#40533</a> Clarify FIPS instructions </li> <li><a href="https://github.com/keycloak/keycloak/issues/40564">#40564</a> Add clarifying language around jgroups failure detection ports </li> <li><a href="https://github.com/keycloak/keycloak/issues/40566">#40566</a> Synchronization of Polish language in login template <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40579">#40579</a> Add missing translations in email and account theme for Polish lang <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40639">#40639</a> Update documentation about volatile sessions </li> <li><a href="https://github.com/keycloak/keycloak/issues/40641">#40641</a> [docs] fix spelling error in hostname.adoc </li> <li><a href="https://github.com/keycloak/keycloak/issues/40705">#40705</a> Documentation for passkeys for 26.3.0 <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40709">#40709</a> Update javadoc of java admin-client for Keycloak 26.3 <code>admin/client-java</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40765">#40765</a> Make abstract class AbstractUserRoleMappingMapper public </li> </ul> <h3>Bugs</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/27945">#27945</a> Passkey "Avoid same authenticator registration" doesn't work <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/32600">#32600</a> OpenAPI spec: Missing attributes in ClientPolicyConditionRepresentation and ClientPolicyExecutorRepresentation schemas <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/33078">#33078</a> account/ui spinner use patternfly v3 classes instead of patternfly v5 classes <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/35266">#35266</a> Amazon Identity Provider does not accept scope = openid and Keycloak always sets it <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/35278">#35278</a> Double click on social provider link causes page has expired error <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36150">#36150</a> wrong redirect after login timeout for parallel logins <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36320">#36320</a> [Keycloak CI] - User Federation Tests - LDAPUserProfileTest.testMultipleLDAPProviders <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36396">#36396</a> "identity-provider-redirector" does not forward LOGIN_HINT of authentication session <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36562">#36562</a> Social login - Instagram Login test fails, API changed <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36609">#36609</a> Keycloak container incorrectly read CGroups settings on Kernel 6.12 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36622">#36622</a> Login UI edit profile textarea doesn't have styles applied <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/36986">#36986</a> Localization: when the user has forgotten the password, the email is sent in default language, instead of the selected one <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37202">#37202</a> Client scopes evaluate function shows sub claim in access token even if "basic" client scope is not selected <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37269">#37269</a> External IDP error during Step-Up Authentication does no longer route back to browser flow <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37447">#37447</a> account-console no longer provides nonce/state parameter <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37490">#37490</a> [Keycloak CI] - Quarkus IT (windows-latest, win) - QuarkusPropertiesDistTest <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37526">#37526</a> Unexpected Application Initiated Actions Cause Server Errors <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37537">#37537</a> LDAP group mapper skips configured filter and imports all groups with memberOf strategy when fetching the user's groups <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37555">#37555</a> User Federation: Remove imported users modal has wrong text <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37559">#37559</a> Linking user in different browser doesn't work if original window/tab is closed <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37598">#37598</a> Realm context uses route and can't be used in libary <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37648">#37648</a> User Attribute option of SAML "User Attribute Mapper for NameID" should be required <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37720">#37720</a> MSADUserAccountControlStorageMapper attempts to persist a userAccountControl value of 0 on user create, resulting in LDAP error and incomplete user provisioning <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/37899">#37899</a> User email not registered when user has not the permission to edit his email <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38049">#38049</a> Upload of JKS keystore fails with a server error <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38104">#38104</a> Temporary failure in name resolution with nip.io <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38145">#38145</a> Unknown error on authentication-flow delete action <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38161">#38161</a> RawKeycloakDistribution exit code is always 0 <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38251">#38251</a> Importing a realm from a directory fail if the realm contain organizations with users. <code>import-export</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38351">#38351</a> Mail settings can't be provided via environment variables <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38382">#38382</a> Disable user row if not allowed to delete <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38458">#38458</a> [FGAP] [UI] Permission search doesn't execute correct consequent search request <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38482">#38482</a> SAML client certificate not persisted <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38487">#38487</a> [Keycloak Operator CI] - Test remote (slow) - UpdateTest.testExplicitStrategy <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38542">#38542</a> JWK Subtypes fail when mapping JWK to PublicKey <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38602">#38602</a> Keycloak fails to start on MySQL Cluster due to missing primary key in databasechangelog <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38616">#38616</a> Fix alignment of the 'Action' selectbox with the 'Enabled' switch for User federation <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38660">#38660</a> Ldap federation seems to open and keep open a new thread/connection for each ldap request <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38662">#38662</a> Update commands trigger build checks <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38671">#38671</a> Duplicate Key Violation When Reauthenticating After Account Deletion via Google <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38676">#38676</a> Dropdown search input is not cleared after selecting with mouse <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38692">#38692</a> Test coverage for count menthods when filtering <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38703">#38703</a> Password Policy Changes get overwritten in the UI <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38757">#38757</a> Keycloak statefulset is not mapped to any headless service if installed via operator <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38767">#38767</a> Make group required when selecting a specific group creating a premission <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38783">#38783</a> `content.json`'s isVisible flags are ignored in `Root.tsx`'s `mapRoutes` function, which makes the pages still accessible <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38789">#38789</a> [Keycloak JS CI] Admin UI E2E tests on Firefox have failures <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38799">#38799</a> Kerberos principal attribute value "comes back" when cleared. <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38801">#38801</a> Building docker image of keycloak with curl using 2 stage process hangs <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38812">#38812</a> Test failures in CI in Chrome tests <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38846">#38846</a> StatefulSet reconciliation infinitely looping <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38850">#38850</a> Changing a password with the option log out all other sessions doesn't log out offline sessions <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38852">#38852</a> [Organization] Failed authentication (ModelDuplicateException) when e-mail duplicates are allowed on the realm <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38873">#38873</a> Client Credentials tab : "Allow regex pattern comparison" toggle is always "On" on page load <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38893">#38893</a> Multi-stage docker builds fail --optimized validation <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38910">#38910</a> Bug: Hosted Domain Validation Logic Issue in Keycloak Google Identity Provider <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38911">#38911</a> Filtering of user- and admin-events by dateTo always returns empty results <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38913">#38913</a> [FGAP] AvailableRoleMappings do not consider all-clients permissions <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38918">#38918</a> IPv6 support: Broker tests failing with proxy configuration <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38920">#38920</a> Downstream docs have duplicate ID on sampling <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38925">#38925</a> Blocking issue with increasing JVM thread count after migrating from 26.0.8 to 26.1.4 <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38929">#38929</a> Permission details sometimes don't show the name of the client <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38930">#38930</a> [Docs] Broken link in ExternalLinksTest for importmap <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38932">#38932</a> Home button always redirects to master realm when permission denied <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38934">#38934</a> UI: Readonly/disabled profile form input fields are visually indistinguishable from active fields <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38937">#38937</a> Liquibase checksum mismatch when upgrading from Keycloak ≤ 22.0.4 directly to 26.2.x <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38938">#38938</a> Missing null checks in IdentityProviderResource lead to NPE <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38944">#38944</a> Admin UI test "Enable user events" breaks as event metadata has changed <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38964">#38964</a> [26.2.3/26.1.5] Regression: ClientList value is empty in UI for Custom UserStorageProviderFactory <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38970">#38970</a> Authentication request can fail with `unknown_error` <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/38982">#38982</a> JpaRealmProvider getGroupByName return group duplicate due to change of comparison (like vs equal) <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39015">#39015</a> Keycloak operator with update strategy to Auto: missing imagePullSecrets <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39021">#39021</a> After migrating to newer Keycloak, token refreshes using inherited offline sessions return access tokens with invalid exp value <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39022">#39022</a> Setting batch size to 0 in LDAP provider with pagination enabled leads to NPE <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39023">#39023</a> Keycloak 26.2.0 UI Performance Degradation <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39026">#39026</a> Fine-grained-permssion v2 Display problem <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39037">#39037</a> UserInfo request fails by using an access token obtained in Hybrid flow with offline_access scope <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39046">#39046</a> Keycloak 26.2.0 can't authenticate to the H2 database after the upgrade <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39055">#39055</a> After import of keys an export doesn't include these values <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39061">#39061</a> Missing iteration key property in SigningIn Page <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39063">#39063</a> Optimized startup fails from `kc.spi-connections-http-client-default-expect-continue-enabled` passed at runtime <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39065">#39065</a> Issue with SSL and `CertificatereloadManager` in Keycloak 26.2 when using Istio <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39085">#39085</a> Redirects to admin endpoint 404s on hostname-admin / request scheme mismatch <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39096">#39096</a> Release note 26.2.0 has broken link <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39110">#39110</a> jwks_uri endpoint returns content-type as "application/json" instead of "application/jwk+json" or "application/jwk-set+json" <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39119">#39119</a> Evaluate client scopes can corrupt UI completely <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39124">#39124</a> [Operator CI] - Test remote (slow) <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39125">#39125</a> [Keycloak CI] - FIPS UT - Run crypto tests <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39130">#39130</a> Authorization Code Flow Fails Scope Validation After Credential Definition Migration to Realm Level <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39144">#39144</a> Getting Started Podman: We are sorry... HTTPS required <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39146">#39146</a> [FGAP] [UI] Searching for permissions doesn't allow to search for all group permissions <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39150">#39150</a> Evaluation should consider roles granted to the user <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39156">#39156</a> Quick theme: logo is undefined if not set <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39157">#39157</a> [quarkus-next] TestEngine with ID 'junit-jupiter' failed to discover tests <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39173">#39173</a> duplicate key value violates unique constraint "constraint_offl_cl_ses_pk3" <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39179">#39179</a> Uncaught server error during organization update when name already exists <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39180">#39180</a> Groups view: Filter/search bar disappears and groups not shown after clearing empty search results <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39182">#39182</a> Oracle driver problems in keycloak 26.2.1 <code>dependencies</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39187">#39187</a> Account console: defaultLocale item in select locale field <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39206">#39206</a> Wrong UDP jgroups metric name <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39219">#39219</a> Serverinfo response grows over time <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39227">#39227</a> Quarkus devtools dependencies in 26.2.x <code>dependencies</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39237">#39237</a> Deletion of a role is slow when when there are a lot of roles in the database <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39246">#39246</a> Duplicate user entries when searching custom attributes <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39259">#39259</a> Admin E2E tests ignores `RETRY_COUNT` environment variable <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39262">#39262</a> Keycloak does not take into account value request parameter in the claims request for acr claim <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39264">#39264</a> [OID4VCI] Documentation Errors <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39267">#39267</a> Avoid a NPE at org.keycloak.email.freemarker.beans.ProfileBean#getOrganizations when feature "organization" is disabled <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39274">#39274</a> Aurora DB should not update automatically to the latest minor version <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39296">#39296</a> Inconsistent "grant_types" vs "grantTypes" Naming Causes GrantTypeCondition to Always Fail <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39312">#39312</a> SLO measurement should mention a month as a period <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39336">#39336</a> Tests failing with embedded undertow due the infinispan <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39345">#39345</a> Ghost user entries in database from ldap causes import errors <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39349">#39349</a> CVE-2025-3910 Two factor authentication bypass </li> <li><a href="https://github.com/keycloak/keycloak/issues/39350">#39350</a> CVE-2025-3501 Keycloak hostname verification </li> <li><a href="https://github.com/keycloak/keycloak/issues/39358">#39358</a> Aggregated policy: Cannot select policies that do not appear in the drop-down list <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39402">#39402</a> Client Scope with mapper Organization Membership - claim disappears as soon as user is member of more than one Organisation <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39403">#39403</a> Client Scope with mapper Organization Membership - organizations claim disappears when Include in token scope is off <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39429">#39429</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionsAtRandomNode <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39442">#39442</a> Non-closing HTML tag in footer example <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39450">#39450</a> quarkus runtime options are treated as buildtime options <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39454">#39454</a> JGroups errors when running a containerized Keycloak in Strict FIPS mode and with Istio <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39457">#39457</a> Typos in French login and email messages templates <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39465">#39465</a> Scheduled Task cannot access realm when feature fpap:v2 is active, but realm has it not configured <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39485">#39485</a> Inconsistent "Forgot Password" behavior reveals user account information <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39487">#39487</a> Incorrect tooltip over enabled features <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39492">#39492</a> Check if suspicious log about CORS is correct </li> <li><a href="https://github.com/keycloak/keycloak/issues/39496">#39496</a> [26.2.3/26.1.5] Regression: empty ClientList in UI for Custom UserStorageProvider <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39499">#39499</a> UI does not show user's attributes after reentering the Attributes TAB <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39500">#39500</a> Update Job Pod is listed in the keycloak discovery service <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39502">#39502</a> Refreshed tokens are not persisted for IDP token exchange <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39509">#39509</a> UI does not show organization's attributes after reentering the Attributes TAB <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39538">#39538</a> Autocomplete in Mapper type of user federation broken <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39540">#39540</a> Forms IT tests breaks with Chrome 136.0.7103.59 <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39549">#39549</a> Inconsistency in User enabled status in Rest query results. <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39596">#39596</a> Enabling "HTTP-POST binding response" is not reflected in the SP metadata <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39599">#39599</a> Error when requesting token inspection for a access token requested by a offline token <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39612">#39612</a> Unable to change the OTP hash algorithm <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39614">#39614</a> Keycloak not using custom Infinispan config <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39643">#39643</a> Can't change locale on expired page <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39663">#39663</a> Duplicate validation message “Please specify username.” shown on login form <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39668">#39668</a> Fetching 1250 group children much slower in v26 vs. v25 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39669">#39669</a> Hide update email link in account console when email is read-only in user profile <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39693">#39693</a> Clicking on the jump links removes the localization of the UI <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39697">#39697</a> Authorization documentation shows the wrong view <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39710">#39710</a> Recreate update is not scaling down the statefulset to zero <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39715">#39715</a> Users Credentials tab crashes on orphan LDAP user <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39720">#39720</a> User listing broken because of missing `is_temporary_admin` attribute <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39724">#39724</a> Hibernate LazyInitializationException when deleting client with CompositeRoles <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39753">#39753</a> POST realm API returns 400 on conflict instead of 409 in version 26.2.4 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39759">#39759</a> ModelDuplicateException since Keycloak v26 when logging into Keycloak <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39765">#39765</a> SAML certificate in UI not refreshed after keystore import <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39781">#39781</a> SMTP password overwritten with asterisks <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39785">#39785</a> Client sessions are not cached when loaded from the database <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39798">#39798</a> Documentation has outdated link to the "latest" branch of quickstarts <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39800">#39800</a> [KEYCLOAK CI] - AuroraDB IT - Create EC2 runner instance <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39816">#39816</a> Do not show warning ISPN000312: Lost data because of graceful leaver <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39843">#39843</a> Custom classes for checkbox are not applied on password reset form in keycloak.v2 login theme <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39850">#39850</a> [FGAP] Clients empty when using role based policy and roles inherited from groups <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39861">#39861</a> [Keycloak CI] - Several failures HTTP response code 429 - too many requests <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39866">#39866</a> MigrationModel duplicate entry on Recreate Upgrade in Cluster with 2+ nodes <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39876">#39876</a> JS CI fails with merging playwright reports <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39893">#39893</a> Missing Quarkus flag for syslog logging <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39904">#39904</a> Missing angle bracket <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39915">#39915</a> Searching user by attributes force an exact request even if not asked <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39917">#39917</a> Liquibase update failed from KC 26.1 to KC 26.2 with PostgreSQL JDBC driver 42.7.5 <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39918">#39918</a> Admin UI key permissionPoliciesHelp possible typo <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39920">#39920</a> Admin UI doesn't use conditionsHelpItem message key <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39923">#39923</a> ModelDuplicateException on next login after deleting an account <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39934">#39934</a> Locale set to English even when only one Locale is enabled <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39937">#39937</a> Admin UI shows message "Imported users have been removed" twice <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39939">#39939</a> Operator error: desiredPullSecrets is null <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39942">#39942</a> LDAP Edit mode option is required but not marked <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39949">#39949</a> [Keycloak JavaScript CI] - Admin UI E2E (firefox) <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39950">#39950</a> [Keycloak CI] - Cookies Tests - KcOidcBrokerTokenExchangeTest </li> <li><a href="https://github.com/keycloak/keycloak/issues/39956">#39956</a> Allow mapping Admin roles to server administrator only <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/39971">#39971</a> Custom tabs implementing UiTabProvider/UiTabProviderFactory not displayed since KC26.2.0 <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40003">#40003</a> Change connection settings totle to OAuth2 settings </li> <li><a href="https://github.com/keycloak/keycloak/issues/40046">#40046</a> Cache TLS is not available with protocol UDP after upgrading from 26.2.4 to 26.2.5 <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40049">#40049</a> Flaky test: org.keycloak.testsuite.webauthn.account.WebAuthnSigningInTest#checkAuthenticatorTimeLocale <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40085">#40085</a> Federated user IDs are not correctly evicted from cache <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40088">#40088</a> Make UPDATE_TIME unique for MIGRATION_MODEL table </li> <li><a href="https://github.com/keycloak/keycloak/issues/40090">#40090</a> Emphasize using StatefulSet instead of Deployment <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40096">#40096</a> Error creating user in Windows Active Directory over LDAP <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40099">#40099</a> [Keycloak Operator CI] - Test OLM Installation <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40104">#40104</a> NPE during external-internal token exchange in case that user exists <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40106">#40106</a> Two same tests in KcOidcBrokerTokenExchangeTest <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40128">#40128</a> Unable to set LoA field in auth-flow-enforcer <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40135">#40135</a> Transparent filter panel in Admin > Events > Search events form <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40139">#40139</a> Incorrect placeholder for "delete multiple users" title in German translation <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40151">#40151</a> Avoid unbalanced curly braces in message properties <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40159">#40159</a> Brute force detection permanent lockout flag not shown for users auto-unlocked after temporary lockout <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40171">#40171</a> SQL error when logging in for first time (per user) after Keycloak upgrade <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40180">#40180</a> Admin UI doesn't show client names from resource bundle <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40187">#40187</a> Client Registration with fake scope <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40195">#40195</a> Documentation of Argon2 hash-length configuration property is incorrect. <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40213">#40213</a> `UserStorageManager.getUserById` called multiple times on `POST /realms/{realm}/protocol/{protocol}/token` <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40232">#40232</a> Setting of `type` of `Argon2PasswordHashProviderFactory` is incorrect, <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40235">#40235</a> PasswordHashingTest#testPasswordRehashedWhenCredentialImportedWithDifferentKeySize fails to successfully log in <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40240">#40240</a> Capitalize each word of the string "security admin console" </li> <li><a href="https://github.com/keycloak/keycloak/issues/40253">#40253</a> Case sensitive Organization/IDP linking on domain <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40270">#40270</a> LDAP: error code 19 - pwdChangedTime: no user modification allowed <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40284">#40284</a> Webauthn policy data resets to previous state after binding flow <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40303">#40303</a> Account UI goBack link doesn't render when referrer query string is set <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40339">#40339</a> [Keycloak CI] - Windows: local maven repository error <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40353">#40353</a> Issue with Handling Negative Values in Certain Fields of Brute Force Detection <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40360">#40360</a> [Keycloak-Operator]: Rolling Updates -- Strategy=Auto, operator error keycloak-update-job is invalid -- Strategy=Explicit, operator always replaces <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40365">#40365</a> Labeler fails to set version of parent issue <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40375">#40375</a> Outdated information in HA Keycloak deployment <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40402">#40402</a> Failing WebAuthn IT (chrome) / WebAuthnSigningInTest.passwordlessWebAuthnTest <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40408">#40408</a> Multiple QuarkusJpaUpdaterProvider calls during boot <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40423">#40423</a> Missing highlighting of deprecated and disabled-by-default features <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40438">#40438</a> Unable to retrieve `attributes` with organization get members endpoint <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40444">#40444</a> Link to dynamic client registration section is broken in docs <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40451">#40451</a> Compilation error in AbstractWebAuthnAccountTest <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40474">#40474</a> WebAuthn Passwordless Policy Timeout Field Causes Syntax Error When Value Exceeds 1000 Seconds Due to Locale-Specific Number Formatting in FTL Generated JavaScript <code>adapter/javascript</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40479">#40479</a> Federation unlink failure message contains double single quotes <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40483">#40483</a> Missing adjustment about offline session caches for volatile sessions <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40494">#40494</a> On change of language, confirmation is shown in old language <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40497">#40497</a> Creating a user profile attribute "displayName" does not work as expected. <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40498">#40498</a> Account UI e2e tests do not run in CI <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40514">#40514</a> Authentication flows documentation should match new GUI <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40531">#40531</a> DefaultLazyLoader is not thread safe, but is used in a shared instance of CachedRealm <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40542">#40542</a> Nightly build shows outdated information on the Keycloak website <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40596">#40596</a> UI Customization missing footer example <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40598">#40598</a> Account console reports duplicate keys in development mode <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40611">#40611</a> Negative expiration for token exchange using an offline session <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40632">#40632</a> Translation key missing from Greek translations. <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40637">#40637</a> Front logout channel broken in 26.2.5 for saml <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40663">#40663</a> Potential copy-paste issue in PersistentClientSessionEntity.java <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40694">#40694</a> quarkus-next: update Quarkus snapshots url <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40695">#40695</a> Multiple resources that match same URI with different scope cause inconsistent authorization response <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40717">#40717</a> Allow passkeys login when user has no password credential <code>authentication/webauthn</code></li> </ul> </div>