Keycloak 26.8.0 — Release Notes & Engineering Impact

<div> <h2>Highlights</h2> <div class="paragraph"> <p>This release features new capabilities for users and administrators of Keycloak. The highlights of this release are:</p> </div> <div class="ulist"> <ul> <li> <p>Issue and verify digital wallet credentials with OID4VCI and OID4VP</p> </li> <li> <p>Automate user provisioning across identity systems with the SCIM API</p> </li> <li> <p>Run multi-cluster deployments without an external cache using stateless mode (now supported)</p> </li> <li> <p>Simpler administration with automatic index creation, reduced memory usage, and enhanced HTTP performance</p> </li> <li> <p>Token exchange delegation for AI agents and automation with consent and FGAP authorization</p> </li> </ul> </div> <div class="paragraph"> <p>Read on to learn more about each new feature. If you are upgrading from a previous release, <a href="https://www.keycloak.org/docs/latest/upgrading/index.html">also review the changes listed in the upgrading guide</a>.</p> </div> <div class="sect2"> <h3 id="_security_and_standards">Security and Standards</h3> <div class="sect3"> <h4 id="_verifiable_credential_issuance_promoted_to_preview_with_credential_management_and_revocation">Verifiable Credential Issuance promoted to preview with credential management and revocation</h4> <div class="paragraph"> <p>The <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html">OpenID for Verifiable Credential Issuance (OID4VCI)</a> feature has been promoted from experimental to preview. It can now be enabled with <code>--features=preview</code> or <code>--features=oid4vc-vci</code>.</p> </div> <div class="paragraph"> <p>Credential lifecycle management now includes revocation when refresh tokens are revoked, and a new Application Initiated Action (AIA) lets users request credential issuance within an authenticated session. Key attestation is configurable in the admin console with hardened x5c certificate validation following the HAIP profile. This release also adds experimental support for the mdoc format, provided by the new experimental feature <code>oid4vc-mdoc</code>. Integration guides for the Lissi and Valera wallets are available, along with documentation for SD-JWT signing key setup, credential management, and revocation.</p> </div> <div class="paragraph"> <p>Example applications are provided in this release (for illustration, not officially supported):</p> </div> <div class="ulist"> <ul> <li> <p><a href="https://github.com/keycloak/keycloak-oauth-sig/tree/main/oid4vci-deployment">Quickstart OID4VCI deployment</a> - a playground for rapid prototyping with mdoc and SD-JWT credentials</p> </li> <li> <p><a href="https://github.com/keycloak/keycloak-playground/tree/main/fapi-playground#oid4vci-demo">OID4VCI Demo in Keycloak FAPI playground</a> - available to show the details of the OID4VCI protocol messages exchanged between wallet and issuer, and to illustrate advanced concepts like proofs, attestation, credential refresh, and more.</p> </li> </ul> </div> <div class="paragraph"> <p>The attestation-based client authentication (<code>client-auth-abca</code>), pre-authorized code grant (<code>oid4vc-vci-preauth-code</code>), REST credential offer endpoint (<code>oid4vc-vci-rest-credential-offer</code>), and OpenID4VP (<code>oid4vc-vp</code>) remain experimental features.</p> </div> <div class="paragraph"> <p>Many community members were involved in the development. Many thanks to <a href="https://github.com/Awambeng">Awambeng</a>, <a href="https://github.com/babisRoutis">Babis Routis</a>, <a href="https://github.com/CAOShurong">ShurongCAO</a>, <a href="https://github.com/Captain-P-Goldfish">Pascal Knüppel</a>, <a href="https://github.com/thomasdarimont">Thomas Darimont</a>, <a href="https://github.com/dominikschlosser">Dominik Schlosser</a>, <a href="https://github.com/forkimenjeckayang">forkimenjeckayang</a>, <a href="https://github.com/francis-pouatcha">Francis Pouatcha</a>, <a href="https://github.com/hagerm98">Hager Khamis</a>, <a href="https://github.com/IngridPuppet">Ingrid Kamga</a>, <a href="https://github.com/namanONcode">Naman Jain</a>, <a href="https://github.com/officialasishkumar">Asish Kumar</a>, <a href="https://github.com/Ogenbertrand">Ogen Bertrand</a>, <a href="https://github.com/pulsastrix">Hugo Hakim Damer</a>, <a href="https://github.com/r0h1tb">Rohit Behera</a>, <a href="https://github.com/rameshkumarkoyya">rameshkumarkoyya</a>, <a href="https://github.com/shashankxrm">Shashank RM</a>, <a href="https://github.com/tdiesler">Thomas Diesler</a>, <a href="https://github.com/VinodAnandan">Vinod Anandan</a>, <a href="https://github.com/Vitalisn4">Palpable</a> and <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contributions!</p> </div> </div> <div class="sect3"> <h4 id="_verify_credentials_with_oid4vp_experimental">Verify credentials with OID4VP (experimental)</h4> <div class="paragraph"> <p>Organizations adopting verifiable credentials need a way to accept credential presentations from digital wallets as part of login flows, without requiring a traditional password.</p> </div> <div class="paragraph"> <p>Keycloak can now act as an OID4VP verifier, enabling authentication flows where users present verifiable credentials from their wallets. The verifier supports cross-device presentation flows and the <code>direct_post.jwt</code> encrypted response mode. Trust material for credential verification can be delegated to an external identity provider by alias, and SD-JWT User Attribute and Session mappers are available to extract claims from presented credentials.</p> </div> <div class="paragraph"> <p>Thanks to <a href="https://github.com/dominikschlosser">Dominik Schlosser</a> for this contribution.</p> </div> </div> <div class="sect3"> <h4 id="_react_to_account_status_changes_with_shared_signals_framework_experimental">React to account status changes with Shared Signals Framework (experimental)</h4> <div class="paragraph"> <p>The experimental Shared Signals Framework (SSF) support now emits RISC <code>account-disabled</code> and <code>account-enabled</code> event types when a user is enabled or disabled, extending coverage beyond the CAEP session and credential events that shipped in 26.7. Additionally, the event structure has been revised for better alignment with the CAEP and RISC specifications, and the admin event store no longer receives unvalidated payloads to prevent PII leakage.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/securing-apps/ssf-support">Shared Signals Framework</a> guide.</p> </div> </div> <div class="sect3"> <h4 id="_parameterized_formerly_dynamic_scopes_preview_support_preview">Parameterized (formerly dynamic) scopes preview support (preview)</h4> <div class="paragraph"> <p>Parameterized scopes (formerly known as dynamic scopes) allow clients to pass a parameter value along with the scope name in an OAuth 2.0 authorization request. This is especially useful when a scope represents an entity with a large or dynamic set of values (for example a project name like <code>project:12345</code>), preventing the need to pre-define countless individual client scopes in Keycloak.</p> </div> <div class="paragraph"> <p>Parameterized scopes have officially moved from experimental to preview status.</p> </div> <div class="paragraph"> <p>For more details about the feature, see the <a href="https://www.keycloak.org/docs/26.8.0/server_admin/#_parameterized_client_scopes">Server Administration Guide</a>.</p> </div> </div> <div class="sect3"> <h4 id="_token_exchange_delegation_with_consent_fgap_authorization_and_audit_trail_preview">Token exchange delegation with consent, FGAP authorization, and audit trail (preview)</h4> <div class="paragraph"> <p>Applications such as AI agents and automation tools need limited, consent-based access to act on behalf of a user without requiring administrator privileges or exposing sensitive credentials.</p> </div> <div class="paragraph"> <p>Users can now delegate access to a client application through OAuth consent using the new <code>delegation:client:&lt;client-id&gt;</code> parameterized scope. The resulting token includes an <code>act</code> claim identifying the client as the actor. Unlike admin-user delegation, client delegation does not grant Admin API access even if the client holds service account credentials, ensuring that a leaked delegation token cannot escalate privileges. The <code>delegation:user</code> and <code>delegation:client</code> client scopes are now auto-created as Optional scopes in all realms, and delegation authorization is controlled exclusively through Fine-Grained Admin Permissions V2 using the <code>delegate</code> and <code>delegate-members</code> scopes. Delegation audit events now include the client identity, and standard token exchange rejects subject tokens carrying delegation claims to prevent bypass. A new client policy executor allows administrators to restrict the <code>may_act</code> claim in access tokens, giving per-client control over which clients can participate in delegation.</p> </div> <div class="paragraph"> <p>Token exchange delegation support status is now preview.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/securing-apps/token-exchange#_token-exchange-delegation">Token exchange delegation</a> section.</p> </div> <div class="sect4"> <h5 id="_track_impersonation_across_token_lifecycle_and_downstream_services">Track impersonation across token lifecycle and downstream services</h5> <div class="paragraph"> <p>When an administrator impersonates a user, downstream resource servers and audit systems had no reliable way to identify that a token was issued under impersonation or who the impersonator was.</p> </div> <div class="paragraph"> <p>Token lifecycle events (<code>CODE_TO_TOKEN</code>, <code>REFRESH_TOKEN</code>, and others) are now enriched with <code>impersonator</code> and <code>impersonator_id</code> details, providing a complete audit trail across all token operations performed under impersonation. Additionally, tokens issued from impersonation sessions now include the <code>act</code> (actor) claim (<a href="https://datatracker.ietf.org/doc/html/rfc8693#section-4.1">RFC 8693 Section 4.1</a>) in both access tokens and ID tokens, allowing downstream resource servers to identify the impersonator. The claim is always present and cannot be disabled.</p> </div> </div> </div> <div class="sect3"> <h4 id="_secure_client_cluster_node_registration">Secure client cluster node registration</h4> <div class="paragraph"> <p>A new client policy executor, <code>secure-client-node-hostname</code>, is available to protect against server-side request forgery (SSRF) via the legacy adapter cluster node registration endpoint (<code>/clients-managements/register-node</code>). A confidential client could previously register an attacker-chosen hostname, which Keycloak would later use as the destination for management callbacks such as logout propagation and push-revocation.</p> </div> <div class="paragraph"> <p>When the executor is attached to a client policy, node hostnames are validated against an administrator-configured list of regex patterns before being persisted. Registrations that do not match any pattern are rejected.</p> </div> <div class="paragraph"> <p><strong>This protection is opt-in and must be explicitly configured to take effect.</strong></p> </div> <div class="paragraph"> <p>Administrators managing deployments that use the legacy adapter node registration feature should add the <code>secure-client-node-hostname</code> executor to a client policy and configure the allowed hostname patterns. Hostname patterns match against DNS hostnames and IPv4 addresses. Port suffixes are always rejected. Patterns are matched against the bare hostname or IP address.</p> </div> </div> </div> <div class="sect2"> <h3 id="_administration">Administration</h3> <div class="sect3"> <h4 id="_declarative_client_management_with_admin_api_v2_preview">Declarative client management with Admin API v2 (preview)</h4> <div class="paragraph"> <p>The Client Admin API v2, introduced as an experimental feature in Keycloak 26.7, has been promoted to preview. It can now be enabled with <code>--features=preview</code> or <code>--features=client-admin-api:v2</code>.</p> </div> <div class="paragraph"> <p>The API provides strict validation, declarative configuration, and an accurate OpenAPI specification for managing OIDC and SAML clients. It can be consumed through a Java client, an auto-generated JavaScript client, and a CLI, and the Keycloak Operator uses it to manage clients declaratively via the <code>KeycloakOIDCClient</code> and <code>KeycloakSAMLClient</code> custom resources.</p> </div> <div class="paragraph"> <p>The Operator&#8217;s <code>KeycloakOIDCClient</code> and <code>KeycloakSAMLClient</code> custom resources were also promoted to Preview.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/admin-api/admin-api-v2">Admin API v2</a> guide and the <a href="https://www.keycloak.org/operator/managing-clients">Managing Keycloak Clients</a> operator guide. Feedback is welcome!</p> </div> </div> <div class="sect3"> <h4 id="_client_secret_rotation_supported">Client Secret Rotation (supported)</h4> <div class="paragraph"> <p>Rotating client secrets in production without downtime required manual coordination and risked service interruptions if the old secret was invalidated before all consumers switched to the new one.</p> </div> <div class="paragraph"> <p>Client Secret Rotation allows confidential clients to rotate their secrets through client policies, keeping up to two concurrently active secrets for seamless rotation without downtime. Administrators can plan the rotation schedule and anticipate when applications need to adopt the new secret, reducing the risk of secret leakage.</p> </div> <div class="paragraph"> <p>In this release, Client Secret Rotation is promoted from preview to supported. For more details, see the <a href="https://www.keycloak.org/docs/26.8.0/server_admin/#_secret_rotation">Server Administration Guide</a>.</p> </div> </div> <div class="sect3"> <h4 id="_invite_users_automatically_with_workflows">Invite users automatically with workflows</h4> <div class="paragraph"> <p>Sending invitation emails to newly created users previously required external automation or a call to the Admin REST API&#8217;s <code>execute-actions-email</code> endpoint.</p> </div> <div class="paragraph"> <p>The new <code>invite-user</code> workflow step sends an action-token email automatically when a user is created, without requiring external tooling or a custom workflow step provider. Administrators can configure which required actions the user must complete (defaulting to password update and email verification), and optionally specify a client and redirect URI for the post-completion flow.</p> </div> <div class="paragraph"> <p>For details, see the <a href="https://www.keycloak.org/docs/26.8.0/server_admin/#_workflow_steps_">Defining Steps</a> guide.</p> </div> <div class="paragraph"> <p>Thanks to <a href="https://github.com/bilkoua">bilkoua</a> for this contribution.</p> </div> </div> <div class="sect3"> <h4 id="_protocol_mapper_allow_list_for_admin_rest_api">Protocol mapper allow-list for Admin REST API</h4> <div class="paragraph"> <p>Client Policies now provide the <code>allowed-protocol-mappers</code> executor to restrict protocol mapper types that can be created or updated through the dedicated Admin REST API protocol mapper endpoints.</p> </div> </div> <div class="sect3"> <h4 id="_scim_api_supported">SCIM API (supported)</h4> <div class="paragraph"> <p>The SCIM (System for Cross-domain Identity Management) API provides a standards-based interface for managing users and groups within a realm. It enables seamless integration with identity management systems and applications that support the SCIM protocol.</p> </div> <div class="paragraph"> <p>In this release, the SCIM API is promoted from preview to supported. The SCIM API received extensive improvements including support for multivalued user attributes, User Profile permissions, Fine-Grained Admin Permissions in search filters, and improved performance for large user bases. For more details, see the <a href="https://www.keycloak.org/docs/26.8.0/server_admin/#_managing_scim">Managing users and groups through SCIM</a> documentation.</p> </div> </div> </div> <div class="sect2"> <h3 id="_configuring_and_running">Configuring and Running</h3> <div class="sect3"> <h4 id="_multi_cluster_v2_supported">Multi-cluster v2 (supported)</h4> <div class="paragraph"> <p>Multi-cluster v2 enables connecting two or more Keycloak clusters without an external Infinispan cluster by using the <code>stateless</code> feature. Session data is stored in the database, simplifying the deployment architecture compared to multi-cluster v1.</p> </div> <div class="paragraph"> <p>In this release, multi-cluster v2 and the <code>stateless</code> feature are promoted from preview to supported. The feature is disabled by default and can be enabled with <code>--features=stateless</code>. A new deployment guide for bare-metal and VM environments is now available alongside the existing Kubernetes guide. For more details, see &lt;@links.ha id="multi-cluster-v2-introduction" /&gt;.</p> </div> </div> <div class="sect3"> <h4 id="_multi_cluster_v1_deprecated">Multi-cluster v1 (deprecated)</h4> <div class="paragraph"> <p>Multi-cluster v1 (the <code>multi-site</code> feature) is deprecated and will be removed in a future major release. Multi-cluster v2, which uses the <code>stateless</code> feature, is the recommended replacement. It simplifies the deployment architecture by eliminating the external Infinispan cluster and its cross-site replication.</p> </div> <div class="paragraph"> <p>If you are using <code>--features=multi-site</code>, migrate to <code>--features=stateless</code>. For migration instructions, see <a href="https://www.keycloak.org/high-availability/multi-cluster-v2/migrate-from-v1-to-v2">Migrating from multi-cluster v1 to v2</a> in the High Availability Guide.</p> </div> </div> <div class="sect3"> <h4 id="_support_for_encrypted_pem_files_for_tls_certificate_and_private_key">Support for encrypted PEM files for TLS certificate and private key</h4> <div class="paragraph"> <p>Deploying Keycloak with encrypted private keys previously required converting them to an unencrypted format or using a keystore, adding operational complexity.</p> </div> <div class="paragraph"> <p>Keycloak now supports encrypted PKCS#8 private keys in PEM format for HTTPS configuration. Use the new <code>--https-certificate-key-file-password</code> option to provide the decryption password. The management interface also supports this via <code>--https-management-certificate-key-file-password</code>. For details, see &lt;@links.server id="enabletls"/&gt;.</p> </div> </div> <div class="sect3"> <h4 id="_login_failures_now_stored_in_the_database">Login failures now stored in the database</h4> <div class="paragraph"> <p>Brute force detection data is now persisted in the database by default, so temporarily locked-out users remain locked out across cluster restarts. Deployments using the <code>multi-site</code> or <code>clusterless</code> features continue to store login failures in the external Infinispan cluster. The previous in-memory behavior is available as <code>login-failures:v1</code> but is deprecated. For details, see the <a href="https://www.keycloak.org/docs/26.8.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> <div class="sect3"> <h4 id="_first_class_cli_options_for_cluster_and_node_name">First-class CLI options for cluster and node name</h4> <div class="paragraph"> <p>The embedded cache cluster name and node name can now be configured with the new <code>--cache-embedded-cluster-name</code> and <code>--cache-embedded-node-name</code> CLI options, replacing the low-level SPI options that were previously required.</p> </div> <div class="paragraph"> <p>By default, the node name is a random value generated on each start, making it difficult to correlate metrics, logs, and JGroups diagnostics across restarts. Setting a stable node name is especially useful for observability tools such as Grafana dashboards and log aggregation.</p> </div> <div class="paragraph"> <p>When deploying with the Keycloak Operator, the node name is now automatically set to the Kubernetes pod name (for example, <code>keycloak-0</code>). For standalone deployments on Kubernetes, set <code>KC_CACHE_EMBEDDED_NODE_NAME</code> using the downward API to inject the pod name. For non-Kubernetes deployments, pass <code>--cache-embedded-node-name=&lt;name&gt;</code> with a value that uniquely identifies each node.</p> </div> </div> <div class="sect3"> <h4 id="_automatic_non_blocking_index_creation_for_large_tables">Automatic non-blocking index creation for large tables</h4> <div class="paragraph"> <p>When upgrading Keycloak with large database tables, index creation was previously skipped during schema migration to avoid blocking startup. Operators had to create the missing indexes manually.</p> </div> <div class="paragraph"> <p>Keycloak now automatically creates skipped indexes in the background after startup using non-blocking index creation on PostgreSQL, Oracle, MySQL/MariaDB, and supported Microsoft SQL Server editions. Invalid PostgreSQL indexes left by failed previous attempts are detected and recreated automatically. On databases without non-blocking support, Keycloak continues to log the SQL for manual execution.</p> </div> </div> <div class="sect3"> <h4 id="_vert_x_based_outbound_http_client_experimental">Vert.x-based outbound HTTP client (experimental)</h4> <div class="paragraph"> <p>Keycloak uses the Apache HTTP Client for all outgoing connections to external services such as identity providers, OCSP responders, and backchannel logout endpoints. As Keycloak already runs on Vert.x/Netty for inbound traffic, using a separate HTTP stack for outbound connections adds unnecessary complexity and dependency overhead.</p> </div> <div class="paragraph"> <p>Keycloak now provides an experimental Vert.x-based HTTP client that replaces the Apache HTTP Client with Vert.x/Netty for all outgoing connections. To enable it, start Keycloak with <code>--features=http-client:v2</code>.</p> </div> <div class="paragraph"> <p>When enabled, all outgoing HTTP traffic uses the Vert.x HTTP client. Existing configuration options work the same way.</p> </div> <div class="paragraph"> <p>For more details, see the <a href="https://www.keycloak.org/server/outgoinghttp">Configuring outgoing HTTP requests</a> guide.</p> </div> </div> <div class="sect3"> <h4 id="_helm_chart_operator_install_experimental">Helm Chart Operator install (experimental)</h4> <div class="paragraph"> <p>Keycloak now releases an experimental Helm chart to install the Operator.</p> </div> <div class="paragraph"> <p>For installation instructions, see the <a href="https://www.keycloak.org/guides#operator">Operator Guide</a>.</p> </div> </div> </div> <div class="sect2"> <h3 id="_organizations">Organizations</h3> <div class="sect3"> <h4 id="_shared_identity_providers_across_organizations">Shared identity providers across organizations</h4> <div class="paragraph"> <p>Identity providers can now be linked to multiple organizations, enabling scenarios such as a single corporate identity provider serving users across different business units or subsidiaries, each represented as a separate organization. Each identity provider link carries its own auto-membership and membership type configuration, allowing fine-grained control over how users are onboarded per organization.</p> </div> <div class="paragraph"> <p>Domain routing has been moved from the identity provider to the domain entity. Each domain can independently specify which identity provider handles authentication and whether users are auto-redirected. The domain gate ensures cross-organization isolation&#8201;&#8212;&#8201;a user is only auto-added to an organization that claims their email domain, even when multiple organizations share the same identity provider.</p> </div> <div class="paragraph"> <p>New identity provider links created after upgrading default to the Unmanaged membership type. Existing links are migrated with the Managed type to preserve previous behavior.</p> </div> <div class="paragraph"> <p>For setup instructions and common configuration patterns, see <a href="https://www.keycloak.org/docs/26.8.0/server_admin/#common-organization-setup-recipes_server_administration_guide">Common setup recipes</a> in the Server Administration Guide. For migration details, see the <a href="https://www.keycloak.org/docs/26.8.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> </div> <div class="sect2"> <h3 id="_themes">Themes</h3> <div class="sect3"> <h4 id="_redesigned_identity_provider_buttons_on_the_login_page">Redesigned identity provider buttons on the login page</h4> <div class="paragraph"> <p>The social identity provider section on the login page has been refreshed with updated icons, a new divider layout, and improved button labels.</p> </div> <div class="paragraph"> <p>If you have a custom login theme, see the <a href="https://www.keycloak.org/docs/26.8.0/upgrading/">Upgrading Guide</a> for details on what changed.</p> </div> </div> </div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/#migration-changes">the migration guide</a> for a complete list of changes.</p> <h2>All resolved issues</h2> <h3>Security fixes</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/50444">#50444</a> [CVE-2026-12388] IdP mapper admin role escalation <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50618">#50618</a> [CVE-2026-14781] OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51865">#51865</a> [CVE-2026-19608] Name-only group claims let same-name groups satisfy path-specific group policies <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52168">#52168</a> CVE-2026-54515 CVE-2026-59889 com.fasterxml.jackson.core:jackson-databind 2.22.0 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52169">#52169</a> CVE-2026-59903 io.netty:netty-codec-http:4.1.136.Final <code>dist/quarkus</code></li> </ul> <h3>Weaknesses</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/47295">#47295</a> LDAP bind credentials sent to new server when connection URL is changed <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49022">#49022</a> SAML ECP endpoint returns inconsistent Content-Type on error responses <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49220">#49220</a> Client GET endpoints return raw client secrets to view-clients role holders <code>admin/rbac</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49239">#49239</a> Stop storing client private keys in the database and deprecate generate endpoints <code>admin/rbac</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49242">#49242</a> SMTP masked credential substitution does not verify destination fields haven't changed <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49610">#49610</a> Document trust boundaries for attribute-based conditions with self-registration enabled <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49784">#49784</a> UserInfo Endpoint: Add null-check for SignatureProvider when validating JWT bearer tokens <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49785">#49785</a> UserInfo Endpoint: Handle malformed Content-Type header gracefully <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50123">#50123</a> Client baseUrl URI-scheme validation missing during realm and partial import <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50124">#50124</a> OIDC: Inverted return value in `compareSessionIdWithSessionCookie()` backwards-compatibility path <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50131">#50131</a> Client Policies: `allowed-protocol-mappers` enforcement missing for Admin REST API protocol mapper operations <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50135">#50135</a> OIDC: PAR request URIs stored in single-use cache without realm binding <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50368">#50368</a> OID4VCI: Account API delete endpoint for issued verifiable credentials missing ownership validation <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50468">#50468</a> Parameterized Scopes: Pre-authentication username enumeration via username/delegation scope types </li> <li><a href="https://github.com/keycloak/keycloak/issues/50469">#50469</a> Parameterized Scopes: First-match prefix resolution allows permissive scope to shadow stricter scope </li> <li><a href="https://github.com/keycloak/keycloak/issues/50470">#50470</a> Parameterized Scopes: CustomRegexScopeType applies admin regex to unbounded attacker input without length cap </li> <li><a href="https://github.com/keycloak/keycloak/issues/50471">#50471</a> SCIM: Missing lower-bound validation on count parameter in list operations <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50473">#50473</a> SCIM: Groups endpoint members operations do not enforce isAdminUser check <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50475">#50475</a> SCIM: PATCH operations list has no size limit — missing maxOperations enforcement <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50489">#50489</a> Client API v2: Temporary client creation via addClient() shim bypasses realm-level authorization <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50493">#50493</a> Client API v2: Operator disables TLS hostname verification for admin connection <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50517">#50517</a> OID4VCI: key_attestations_required not enforced when key_attestation header absent from proof JWT <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50518">#50518</a> OID4VCI: Key attestation x5c chain validated against system cacerts with no EKU or revocation <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50520">#50520</a> OID4VCI: Unbounded expire parameter on /create-credential-offer allows indefinite pre-auth codes <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50521">#50521</a> OID4VCI: getAttestationRequirements() hardcodes proof-type key to jwt ignoring other types <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50523">#50523</a> OID4VCI: LD-VC signer fetches remote @context URLs over HTTP with no allowlist or cache <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50524">#50524</a> OID4VCI: User-editable did attribute used as credential subject with realm-local uniqueness only <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50533">#50533</a> Identity Broker v2: Wrong-IdP token returned after account-linking due to un-namespaced session note <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50602">#50602</a> Handling HTTP/2 connection coalescing issues originating from wildcard certificates <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50749">#50749</a> OID4VC JWT proof JWK claim type confusion crashes proof validation <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50934">#50934</a> Credential request decryption accepts RSA1_5 for RSA-OAEP-256 encryption keys <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50965">#50965</a> URI client-policy executors omit OIDC front-channel logout URI <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50985">#50985</a> SCIM Users filter leaks hidden group membership under FGAP <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50986">#50986</a> SCIM Groups filter leaks hidden user membership under FGAP <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50987">#50987</a> SCIM reads and filters bypass user-profile view permissions for mapped attributes <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50988">#50988</a> Workflow group membership events confuse slash-named groups with nested paths <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50989">#50989</a> Workflow role grant events match client and realm roles by bare name <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50991">#50991</a> SCIM user writes bypass user-profile edit permissions for custom attributes <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50999">#50999</a> Same-second refresh-token rotation allows stale token replay <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51109">#51109</a> SD-JWT verification accepts signatures whose algorithm differs from the JWS header <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51127">#51127</a> Persistent User Sessions: cache-miss unconditionally re-hydrates cache from DB, resurrecting deleted sessions <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51139">#51139</a> Server info exposes database operational details to view-realm administrators <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51158">#51158</a> User partial filters ignore ancestor group membership denies <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51211">#51211</a> SAML: Add signature verification for inbound LogoutResponse messages <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51212">#51212</a> JOSE: Base64Url decoder throws unchecked exception on padding-only input <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51241">#51241</a> Client update admin events retain private-key attributes <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51242">#51242</a> Registration access token regeneration stores live bearer tokens in admin events <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51243">#51243</a> RP-initiated logout can suppress upstream broker logout with forged initiating_idp <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51276">#51276</a> Unrestricted Class.forName() on query parameter in ComponentResource.getSubcomponentConfig <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51311">#51311</a> Unauthenticated NullPointerException (HTTP 500) on OIDC Dynamic Client Registration PUT via the "scope" field (CWE-476) <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51328">#51328</a> Client type read-only client properties can be bypassed during registration <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51535">#51535</a> Admin API v2 client update does not clean up stale rotated secret attributes <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51699">#51699</a> Missing security headers on root-path redirect when http-relative-path is configured <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52013">#52013</a> [OID4VCI] unauthenticated RSA1_5 padding oracle in OID4VCI credential requests <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52058">#52058</a> Add warning about dynamic urls to reflect the danger of hostname pollution <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52105">#52105</a> OID4VC issued credential deletion not scoped to path user or realm <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52106">#52106</a> SAML metadata key cache is not invalidated on client updates <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52398">#52398</a> Concurrent completion of one WebAuthn registration ceremony persists multiple passwordless credentials <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52400">#52400</a> LDAP password-policy response control parser defects — warning/error tag collision (forced-password-change forgery and suppression) plus uncaught NumberFormatException login failure <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52598">#52598</a> SCIM membership PATCH events omit the changed relationship from audit trail <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52599">#52599</a> SCIM legacy query roles infer cross-resource memberships when FGAP is disabled <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52640">#52640</a> SCIM Group DELETE bypasses administrative-resource protection through cascade </li> <li><a href="https://github.com/keycloak/keycloak/issues/52642">#52642</a> SCIM user deletion skips security-state cleanup </li> <li><a href="https://github.com/keycloak/keycloak/issues/52644">#52644</a> Absence-based completion predicate cannot distinguish consumed from never-persisted events </li> <li><a href="https://github.com/keycloak/keycloak/issues/52645">#52645</a> Bulk HQL executeUpdate bypasses AsyncCommitIntegrator security classification </li> <li><a href="https://github.com/keycloak/keycloak/issues/52646">#52646</a> Concurrent failures at brute-force reset boundary can erase newly recorded attempts </li> <li><a href="https://github.com/keycloak/keycloak/issues/52650">#52650</a> LoginFailureEntity async commit classification can discard failure counters after failover <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52651">#52651</a> Multi-Cluster v2 RPO "No data loss" conflicts with default async commit of ephemeral data <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52664">#52664</a> Password denylist can be bypassed under Turkish locale <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52665">#52665</a> Same-name client role authorizes victim-targeted credential offers via role namespace confusion <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52666">#52666</a> Reusing a rotated OID4VCI refresh token repeatedly reissues credential authority <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52667">#52667</a> User-editable mapped attribute can extend an SD-JWT credential beyond the issuer-configured lifetime <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52668">#52668</a> Credential issuance ignores the administrator-approved attribute snapshot <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52669">#52669</a> Unauthenticated credential requests trigger private-key JWE decryption before bearer authentication <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52670">#52670</a> Refreshing a stolen targeted offer lets another user bypass offer-required issuance <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52671">#52671</a> OID4VCI SD-JWT issuance makes array claims all-or-nothing disclosures <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52681">#52681</a> kcadm preserves world-readable permissions on existing config files <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52684">#52684</a> SCIM search writes raw filter values to debug logs <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52691">#52691</a> Token exchange provider routing allows delegation tokens to bypass actor validation via standard exchange <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52696">#52696</a> Recovered sites can enforce stale security configuration for up to one hour <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52732">#52732</a> [OID4VCI] Make sure that OID4VCI access token usable just for credential endpoint <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52919">#52919</a> OID4VCI: Preventing memory leak and adding decompression limit <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53166">#53166</a> Realm import resets organization-IdP link policy to permissive defaults <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53307">#53307</a> Identity-provider reads disclose organization links outside the caller's scope <code>identity-brokering</code></li> </ul> <h3>Deprecated features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/44062">#44062</a> Should Kerberos Credential delegation be deprecated? </li> <li><a href="https://github.com/keycloak/keycloak/issues/51921">#51921</a> Deprecate legacy OIDC client switches from 'OpenID Connect Compatibility Modes' <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52121">#52121</a> Deprecate volatile sessions and allow opting out of session caching </li> <li><a href="https://github.com/keycloak/keycloak/issues/52923">#52923</a> Deprecate 'Full scope allowed' client switch <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53219">#53219</a> Deprecate other client registration providers than OIDC </li> </ul> <h3>Removed features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/51897">#51897</a> Deprecate route from AUTH_SESSION_ID cookie for sticky sessions </li> <li><a href="https://github.com/keycloak/keycloak/issues/52130">#52130</a> Deprecate clusterless feature </li> <li><a href="https://github.com/keycloak/keycloak/issues/52480">#52480</a> EOL Keycloak Realm Operator </li> </ul> <h3>New features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/16738">#16738</a> Supported client secret rotation </li> <li><a href="https://github.com/keycloak/keycloak/issues/48899">#48899</a> SSF: Add support for RiscAccountPurged event <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50644">#50644</a> [OID4VP] Support direct_post.jwt (encrypted) response mode <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50876">#50876</a> update admin client tests to use sort and filter </li> </ul> <h3>Enhancements</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/16947">#16947</a> group.spec.ts does not contain example of how to add attributes while creating groups <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22524">#22524</a> Improve WebAuthn error messages <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/22962">#22962</a> SAML Responses with Invalid Signatures <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/27437">#27437</a> Accept encrypted PEM TLS certificate key </li> <li><a href="https://github.com/keycloak/keycloak/issues/32080">#32080</a> Infinispan: LoginFailures cache should not be unbounded </li> <li><a href="https://github.com/keycloak/keycloak/issues/40211">#40211</a> Add link to clients in UsedBy hint for auth-flows listing in admin ui <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/40246">#40246</a> Selecting value in combobox not default listed <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43741">#43741</a> Parametrized client_id in the organization invite link and invite token <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/44605">#44605</a> Infinispan metrics should not contain a dynamic node label </li> <li><a href="https://github.com/keycloak/keycloak/issues/44963">#44963</a> PassKey "User verification requirement" error's are not translated <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/46555">#46555</a> Concurrent Index creation on PostgreSQL and other databases for DB migrations <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/47921">#47921</a> Account Console: Add per-application session termination on the Applications page <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/47945">#47945</a> Good proxy instructions for a production ready Keycloak setup </li> <li><a href="https://github.com/keycloak/keycloak/issues/48063">#48063</a> refresh_expires_in is 0 for offline tokens when Offline Session Max Limited is disabled, but server enforces Offline Session Idle <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48216">#48216</a> KeyCloak Admin Client - Support Jackson 3 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48349">#48349</a> Upgrade FreeMarker to the most recent version </li> <li><a href="https://github.com/keycloak/keycloak/issues/48448">#48448</a> DNS Rebinding attacks to create bling SSRF <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48847">#48847</a> Update Vale </li> <li><a href="https://github.com/keycloak/keycloak/issues/49039">#49039</a> Signed JWT - Federated: support managed Kubernetes (EKS, GKE, AKS) via dynamic OIDC issuer discovery <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49044">#49044</a> Better memory management with argon2 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49056">#49056</a> Make the Roles field optional on the client Authorization Evaluate tab </li> <li><a href="https://github.com/keycloak/keycloak/issues/49297">#49297</a> Add `invite-user` workflow step <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49493">#49493</a> [SAST] Restrict direct access to `issuedFor` variable </li> <li><a href="https://github.com/keycloak/keycloak/issues/49549">#49549</a> Upgrade to Quarkus 3.40 LTS </li> <li><a href="https://github.com/keycloak/keycloak/issues/49767">#49767</a> Refactor SSF to use keycloak-admin-client and react hook form </li> <li><a href="https://github.com/keycloak/keycloak/issues/49874">#49874</a> How to create a JFR recording with JDK standard tools <code>observability</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49968">#49968</a> Switch internal HTTP client from Apache to Vert.x/Netty </li> <li><a href="https://github.com/keycloak/keycloak/issues/50159">#50159</a> Make UuidUnmodified more generic so that we can use it on multiple fields <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50221">#50221</a> Add default non-endpoint methods to the admin api v2 interfaces as needed for typing </li> <li><a href="https://github.com/keycloak/keycloak/issues/50695">#50695</a> [OID4VCI] Implement missing HAIP conformance tests <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50803">#50803</a> Document the Password Policy SPI in the Server Developer Guide </li> <li><a href="https://github.com/keycloak/keycloak/issues/50911">#50911</a> Ensure consistent transaction rollback across all error response paths <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50948">#50948</a> Sorting Applications in Account Console </li> <li><a href="https://github.com/keycloak/keycloak/issues/50970">#50970</a> Missing index on WORKFLOW_STATE.SCHEDULED_STEP_TIMESTAMP causes full filter scan in getDueScheduledSteps <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50992">#50992</a> Redesign identity provider buttons on the login page <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51214">#51214</a> Improve runtime when building user representations via User Profile <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51263">#51263</a> Organization group-by-path endpoint returns a brief representation instead of a full representation <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51273">#51273</a> Upgrade to Quarkus 3.37.4 </li> <li><a href="https://github.com/keycloak/keycloak/issues/51305">#51305</a> Token Exchange Delegation for Clients <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51310">#51310</a> Upgrade to Quarkus 3.38 </li> <li><a href="https://github.com/keycloak/keycloak/issues/51359">#51359</a> Complete Identity Provider support in the Test Framework Realm DSL <code>test-framework</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51400">#51400</a> SCIM user serialization creates ~200x more UserProfile instances than necessary </li> <li><a href="https://github.com/keycloak/keycloak/issues/51402">#51402</a> SCIM search/list executes unconditional COUNT(*) query on every request </li> <li><a href="https://github.com/keycloak/keycloak/issues/51403">#51403</a> SCIM filter string is parsed twice through ANTLR4 grammar per request </li> <li><a href="https://github.com/keycloak/keycloak/issues/51413">#51413</a> [CIMD] Resource Indicators with CIMD </li> <li><a href="https://github.com/keycloak/keycloak/issues/51428">#51428</a> Ensure consistent transaction rollback in SCIM error response paths <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51432">#51432</a> Upgrade to Quarkus 3.38.1 </li> <li><a href="https://github.com/keycloak/keycloak/issues/51450">#51450</a> Unify QR code and divider components in the login theme <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51451">#51451</a> [OID4VP] Improve cross-device login page layout <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51455">#51455</a> Unify OTP setup buttons to use shared `buttons` macro <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51481">#51481</a> Introduce dedicated delegation permission for token exchange delegation <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51489">#51489</a> Add actor to impersonation tokens and details to event logs <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51506">#51506</a> Skip unnecessary provider initialization for non-server commands <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51528">#51528</a> Authentication events should distinguish primary vs rotated client secret </li> <li><a href="https://github.com/keycloak/keycloak/issues/51537">#51537</a> Improve help text for admin permissions (FGAP) fields <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51676">#51676</a> Distinguish between Login Theme and Account Console for an already existing Mail in Keycloak </li> <li><a href="https://github.com/keycloak/keycloak/issues/51685">#51685</a> SCIM should also return a forbidden response status for schemas and resourceTypes if the query is present in the request </li> <li><a href="https://github.com/keycloak/keycloak/issues/51687">#51687</a> SCIM filtered search should leverage the Infinispan entity cache <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51701">#51701</a> Store provider.jar mtime in seconds in keycloak-persisted.properties for Quarkus re-augmentation </li> <li><a href="https://github.com/keycloak/keycloak/issues/51797">#51797</a> Keycloak with jdbc-ping stack failed to create a cluster after the MariaDB restore procedure <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51808">#51808</a> Retarget quarkus-next to Quarkus 3.39 branch after 3.x branch was dropped </li> <li><a href="https://github.com/keycloak/keycloak/issues/51851">#51851</a> Avoid contention on IDX_USER_SESSION_EXPIRATION_* indexes on MS SQL/MySQL </li> <li><a href="https://github.com/keycloak/keycloak/issues/51854">#51854</a> Optimize index sizes for session storage in the database </li> <li><a href="https://github.com/keycloak/keycloak/issues/51855">#51855</a> Client configuration changes are not propagated between sites <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51900">#51900</a> Avoid updates to IDX_USER_SESSION_EXPIRATION_LAST_REFRESH on every token refresh </li> <li><a href="https://github.com/keycloak/keycloak/issues/51938">#51938</a> Upgrade to Quarkus 3.39.0.CR1 </li> <li><a href="https://github.com/keycloak/keycloak/issues/51968">#51968</a> Don't wrap exceptions when running tests remotely in the new test framework </li> <li><a href="https://github.com/keycloak/keycloak/issues/52012">#52012</a> Extend asynchronous commit optimization to SQL Server and Oracle </li> <li><a href="https://github.com/keycloak/keycloak/issues/52126">#52126</a> Deprecate in-memory login failures and make persistent login failures the default </li> <li><a href="https://github.com/keycloak/keycloak/issues/52127">#52127</a> Upgrade to Quarkus 3.39.1 </li> <li><a href="https://github.com/keycloak/keycloak/issues/52268">#52268</a> Organization authenticator drops the typed username when falling through to the default identity-provider-redirector (no login_hint) </li> <li><a href="https://github.com/keycloak/keycloak/issues/52356">#52356</a> Upgrade to Quarkus 3.39.2 <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52722">#52722</a> Upgrade to Infinispan 16.0.15 </li> <li><a href="https://github.com/keycloak/keycloak/issues/52943">#52943</a> Upgrade to Quarkus 3.40.0.CR1 </li> <li><a href="https://github.com/keycloak/keycloak/issues/52988">#52988</a> Cache parsed theme resource declarations to avoid re-parsing them on every login page render <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52992">#52992</a> Cache the resolved max-length configuration for OIDC request parameters <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52994">#52994</a> Avoid building the WebAuthn trust verifier on every login <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53010">#53010</a> MCP Documentation for 26.8 </li> <li><a href="https://github.com/keycloak/keycloak/issues/53211">#53211</a> Add session bucket and coarse-grained timestamp to ROOT_AUTH_SESSION for reduced index contention <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53242">#53242</a> SAML broker: IdP-initiated logout fails with HTTP 500 and is rolled back when the IdP has no single logout service URL <code>identity-brokering</code></li> </ul> <h3>Bugs</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/41394">#41394</a> Flow steps back when changing locale or refreshing page (Regression of #30520 / #30644) <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/41433">#41433</a> After update from 26.0 to 26.1 extent account theme keycloak.v3 is not working for custom components <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/44832">#44832</a> User creation problem with default groups defined, with identity provider and federated openldap <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/47482">#47482</a> [quarkus-next] ConcurrentModificationException in parallel Quarkus build steps <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48043">#48043</a> [OID4VCI] c_nonce Replay <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48188">#48188</a> [OID4VCI] Issuance with Authorization Code Flow assumes same client_id for offer creation and redemption <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/48858">#48858</a> 'view-clients' bypasses 'view-users' restriction via 'client-scoped' endpoints <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49077">#49077</a> NullPointerException in ResourceIndicatorsPostProcessor when access token audience is null <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49236">#49236</a> SSF: Client scopes ssf.read and ssf.manage not created when SSF enabled for existing realm <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49731">#49731</a> Creating a new realm from json using kcadm gives a PK violation on KEYCLOAK_ROLE despite it only being defined once in the JSON. <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49891">#49891</a> [OID4VCI] CNF is not included in sd-jwt when number_of_decoys is not explicitly configured <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/49964">#49964</a> Malformed Content-Type header causes HTTP 500 on token endpoints instead of RFC 6749 §5.2 compliant 400 <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50110">#50110</a> Keycloak doesn't honor `--https-trust-store-type` when automatically creating the Trust Store <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50178">#50178</a> Scope-based permission accepts a scope not associated with the selected resource (Admin REST API) <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50190">#50190</a> Admin Console: saving attributes fails when the attribute key is "constructor", "toString", or another Object.prototype name <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50209">#50209</a> LifeSciences Login does not work anymore in Keycloak version 26.6.3 <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50228">#50228</a> SearchQuery.getFields() exceptions <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50362">#50362</a> [CIMD] Claude Desktop authentication rejected by Keycloak: jwt-bearer grant type incompatible with public client <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50535">#50535</a> Admin UI: Resource search does not work in Authorization Evaluate “Resources and Scopes - Key” selector <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50590">#50590</a> ConcurrentModificationException in OrganizationAdapter.setAttributes on concurrent PUT /organizations/{id} <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50596">#50596</a> User federation synchronizations will always evict all users of a realm from the users cache <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50629">#50629</a> REVOKE_GRANT_ERROR prevents logout except when account console is open in another tab <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50684">#50684</a> SAML broker artifact binding fails to validate signed nested Response inside ArtifactResponse: Cannot resolve element with ID <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50687">#50687</a> UI shows inherited role as non-inherited when the same role is also assigned manually <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50691">#50691</a> Email not lowercased in "Always Read Value From LDAP" delegate (incomplete fix from #43254) <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50694">#50694</a> Nightly Conformance tests are failing <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50700">#50700</a> Exporting a realm with users says it needs file parameter, which is provided <code>admin/cli</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50720">#50720</a> Trusted SSF event emission persists verbatim event payload in admin events <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50788">#50788</a> Putting --optimized before command gives confusing error message <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50791">#50791</a> NPE thrown on null secret in AbstractOauth2IdentityProdivder <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50796">#50796</a> ClientManager.isInternalClient checks only for "master" realm <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50800">#50800</a> SCIM: query-users role returns empty Resources array despite correct totalResults <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50807">#50807</a> Dynamic client registration: "scope" member in the request suppresses realm default client scopes on the created client <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50812">#50812</a> Synthetic SSF emit accepts mismatched user and tenant subjects when only the tenant is subscribed <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50813">#50813</a> Keycloak does not apply connect timeout when Oracle runs in XA mode <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50845">#50845</a> Duplicate of #46382, #46178, #46433 : reporting because none were actually fixed for this case. <code>admin/client-js</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50854">#50854</a> NPE in executor configuration validation </li> <li><a href="https://github.com/keycloak/keycloak/issues/50860">#50860</a> Empty or null description causes duplicate "Allowed field:" <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50877">#50877</a> [DOC] FGAPv2: Clarify that manage scope on users and manage-members on group include creating users <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50907">#50907</a> [kcw] `kcw dev` greps incorrect Keycloak version </li> <li><a href="https://github.com/keycloak/keycloak/issues/50944">#50944</a> Flaky Admin UI E2E test: `initial-access.spec.ts` <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50975">#50975</a> Admin UI E2E test failures - SSF Stream <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/50994">#50994</a> Flaky admin UI tests <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51004">#51004</a> Legacy OIDC broker token exchange accepts ID tokens issued to a different audience <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51018">#51018</a> Typo in "Integrating with Model Context Protocol (MCP)" (mcp-authz-server.adoc) <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51064">#51064</a> Flaky test: org.keycloak.testsuite.forms.BrowserFlowTest#testUserWithOneAdditionalFactorOtpSuccess <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51073">#51073</a> Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRequiredAction <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51074">#51074</a> Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredInTheMiddle <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51075">#51075</a> Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRefreshInTab1 <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51076">#51076</a> Flaky test: org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTest <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51100">#51100</a> Recovery codes have numeric input field despite alphanumeric codes being generated <code>login/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51113">#51113</a> Usage of second class configuration may not be masked in show-config <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51123">#51123</a> Logout fails when IdP is disabled <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51128">#51128</a> PreparedStatement can have at most 65,535 parameters <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51137">#51137</a> Token exchange and JWT grants ignore use-lightweight-access-token policy <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51146">#51146</a> Test Authentication fails after correcting LDAP connection URL until configuration is saved <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51153">#51153</a> SCIM filter parentPath not saved/restored in visitValuePath, breaks nested valuePath <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51155">#51155</a> SCIM PATCH does not enforce attribute mutability <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51156">#51156</a> SCIM PATCH NPE when request body contains "schemas": null <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51169">#51169</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test09recoveryAuthnCodesWithThresholdConfigured <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51187">#51187</a> [OID4VCI] Handling of realm optional client scopes <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51191">#51191</a> OID4VPVerifierTestBase failure in CI <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51201">#51201</a> Labeler fails to set the version in the main branch <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51213">#51213</a> Admin API v2: SAML string-attribute mapper does not remove attributes on explicit null or omission <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51253">#51253</a> Do not pass the client for Delegation parameterized scope type <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51256">#51256</a> Flaky test: org.keycloak.testsuite.webauthn.registration.passwordless.PwdLessOtherSettingsTest#apiInvalidStateErrorMessage <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51262">#51262</a> Unable to select authorization scopes beyond the first 100 in Scope-Based Permissions <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51269">#51269</a> LDAP Enabled switch remains interactive for users with view-realm only <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51330">#51330</a> Account already existed page button has no gap and no hover on effect <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51347">#51347</a> [OID4VCI] Incorrect metadata for key_attestations_required <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51352">#51352</a> Better server error message and handling if email sender is disabled in configuration <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51361">#51361</a> InvalidPathException when running test cases in embedded mode on Windows <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51372">#51372</a> Admin Console: changing the search term while on a later page keeps the old page offset and shows no results <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51396">#51396</a> `truststore-paths` certificates are ignored by `FileTruststoreProviderFactory`: it silently falls back to the JDK `cacerts` because it is initialized before `TruststoreBuilder` <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51398">#51398</a> Pin resolved identity to prevent consent transfer on user recreation <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51401">#51401</a> SCIM filter predicates handle case-insensitive matching incorrectly <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51415">#51415</a> Workflow add-required-action does not allow all available required actions <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51423">#51423</a> [UX] account console nav on mobile not closing after selecting a page <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51437">#51437</a> Enabling parameterized-scopes breaks the built-in organization:<alias> scope <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51496">#51496</a> Deleting a user attribute deletes all custom message localizations of default language en <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51498">#51498</a> Admin console Realm Settings delete uses display name instead of realm name (regression from #48084) <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51512">#51512</a> Flaky test: org.keycloak.testsuite.webauthn.registration.AuthAttachmentRegisterTest#authenticatorAttachmentPlatform <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51525">#51525</a> SCIM filtered PATCH remove deletes all values for multivalued extension attributes <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51527">#51527</a> Admin v2 API PATCH bypasses client secret rotation policy <code>admin/api-v2</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51531">#51531</a> Composite realm role mappings endpoint does not scale with the number of realm roles — the #47157 fix was applied only to the client variant <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51536">#51536</a> TypeError crash in Evaluation tab when selecting "Group" resource type <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51550">#51550</a> @InjectSysLogServer from test-framework does not work with defaults anymore <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51552">#51552</a> Refresh Token Introspection <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51559">#51559</a> SPNEGO mutual authentication response token is not returned after successful login <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51571">#51571</a> SSF: Missing event details during user logout trigger NPE <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51590">#51590</a> SCIM: organization groups exposed via the groups attribute on Users <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51600">#51600</a> Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51614">#51614</a> SCIM Users groups filter does not exclude organization groups <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51620">#51620</a> Migrate remaining login pages have no override in the keycloak.v2 theme <code>account/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51674">#51674</a> Keycloak's password length policy isn't triggered when changing password in FIPS mode <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51682">#51682</a> Exceptions in Kubernetes federated-client-authentication signature verification are silently swallowed with no default-level log trace <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51690">#51690</a> [OID4VCI] Labels for OID4VCI events missing in the admin console <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51692">#51692</a> [OID4VCI] Some error events not reported <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51757">#51757</a> Base implementation of AbstractModelSchema.getAttributeMappers is keyed by model attribute name <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51769">#51769</a> Dutch translation for linkExpirationFormatter produces duplicated value ("12 12 uur") <code>translations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51796">#51796</a> Scim complex type attributes are forced to be case-insenitive <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51853">#51853</a> Keycloak Admin Client fails on JS CI <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51913">#51913</a> [quarkus-next] Helm chart CI jobs fail due to missing Quarkus snapshot cache restore <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51934">#51934</a> EXECUTE_ACTION_TOKEN : event impossible to save <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/51943">#51943</a> AdditionalHelmTemplateBuildItem class is sometimes missing thought to random order of Helm dependencies <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52041">#52041</a> [OID4VCI] mdoc not properly configurable in admin console client scope tab <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52087">#52087</a> Regression: resource_access claim becomes empty {} when populated via User Attribute mapper with JSON value (since 26.7.1) <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52103">#52103</a> Log injection via unsanitized client_id in OIDC logout endpoint <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52147">#52147</a> SCIM resource ID phishing <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52157">#52157</a> Organization invitation fails with invalid_redirect_uri when the organization has no Redirect URL configured <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52166">#52166</a> Client-side password policy validation does not treat underscore _ as a special character <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52167">#52167</a> Securing Client Cluster Node Registration via Client Policy Executor <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52181">#52181</a> Organization invitation is lost when the invitee signs up with a realm-level identity provider <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52186">#52186</a> Fix missing arguments in HardcodedLDAPRoleStorageMapper warning log <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52188">#52188</a> Fine-Grained Admin Permissions v2: Cannot view a user who belongs to a group without "view" permission on that group <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52190">#52190</a> [OID4VCI] Cannot unset values when configuring OID4VCI credential scope <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52197">#52197</a> Admin API v2 returns plaintext client secret to view-clients role holders <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52206">#52206</a> User Profile settings allow mapping multiple attributes to the same SCIM attribute <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52207">#52207</a> User creation via SCIM API does not enforce User Profile "required" validation for core user schema attributes <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52208">#52208</a> SCIM User Partial Update Allows Removing Required User Profile Attributes <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52219">#52219</a> Duplicate English text in generateKeysDescription message key <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52223">#52223</a> SCIM API allows updating username even when the Edit username setting is disabled <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52224">#52224</a> SCIM API allows removing username despite it being required <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52229">#52229</a> SCIM API does not enforce User Profile validators <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52230">#52230</a> Missing detailed audit information in group / relam role operatons <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52285">#52285</a> Unsafe workflow pattern in labeler <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52287">#52287</a> Workflows: notify-user email template hardcodes English text, so notifications cannot be fully translated <code>workflows</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52338">#52338</a> DatabaseIndexCheckerTest.testDetectsAndRecreatesInvalidIndexOnPostgresql fails on Aurora <code>testsuite</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52378">#52378</a> Admin REST OpenAPI schema types groups-in-role responses as UserRepresentation <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52396">#52396</a> Organization missing from the login form model on the invitation confirm-membership page <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52421">#52421</a> [OID4VCI] Server-side validations for "Supported proof types" and "Cryptographic binding methods" <code>oid4vc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52441">#52441</a> DPoPBindEnforcerExecutor requires DPoP on client create/update, defeating its own refresh-token-only binding option <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52475">#52475</a> Admin console crashes with a raw TypeError when a group request returns 404 <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52491">#52491</a> Integer overflow in OIDC re-auth max_age comparison (OIDCLoginProtocol) <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52497">#52497</a> Flaky operator test: KeycloakDeploymentTest.testDeploymentDurability fails with "already exists" <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52502">#52502</a> Flaky test: org.keycloak.testsuite.forms.BruteForceTest#testExceedMaxTemporaryLockouts <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52506">#52506</a> Operator CI jobs missing Maven cache restore — dependency download failures <code>ci</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52568">#52568</a> ResourceIndicatorsPostProcessor error does not log appropriate error event <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52574">#52574</a> Regression in 26.7.0: DefaultClientSessionContext.getScopeString() no longer attaches "openid" scope on token refresh when the client omits it from the request <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52580">#52580</a> ClosingStream does not close underlying stream when terminal operation throws an exception <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52583">#52583</a> HHH90010101 warning logged during SCIM concurrent requests due to orphaned Hibernate before-completion callbacks <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52586">#52586</a> HHH100503 INFO message logged during concurrent SCIM requests after constraint violation <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52587">#52587</a> Organization group: removeMember should fail when user is not a member <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52610">#52610</a> Stateless JPA providers: race condition between INSERT ON CONFLICT DO NOTHING and concurrent DELETE <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52611">#52611</a> Cluster event poller: uncaught ClassCastException on malformed event data <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52612">#52612</a> JpaRevokedTokenProvider uses deprecated Time.currentTime() (int) instead of Time.currentTimeSeconds() (long) <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52647">#52647</a> First cluster-readiness probe returns UP before asynchronous CP check completes </li> <li><a href="https://github.com/keycloak/keycloak/issues/52654">#52654</a> Unable to re login after deleting the Identity Provider configurations <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52659">#52659</a> BruteForceTest.testCacheExpiryForTemporaryLockout test is failing after switch to persistent login failures <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52673">#52673</a> SCIM Group PUT overwrites externalId despite schema declaring it immutable <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52675">#52675</a> SCIM Groups endpoints expose and modify service-account membership <code>scim</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52676">#52676</a> CVE-2026-4633 User enumeration via identity-first login when Organizations feature is enabled <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52706">#52706</a> NO_PROXY entries with leading dots or spaces after commas silently fail <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52710">#52710</a> Test framework silently ignores database reuse when testcontainers reuse is not enabled <code>test-framework</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52714">#52714</a> Flaky operator tests: testDeploymentDurability and testDeploymentUpgrade fail with 409 due to leftover StatefulSet <code>operator</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52720">#52720</a> JWT Authorization Grant cannot be configured with Organization-linked IdPs <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52761">#52761</a> Consent screen returns HTTP 500 for a user in more than one organization (regression in 26.7.0) <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52767">#52767</a> Admin Console: Client scopes Evaluate tab does not refresh generated tokens when the user changes <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52785">#52785</a> Device flow does not throw error if scope parameter contains a scope not permitted for client <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52798">#52798</a> NullPointerException when POSTing null payload to /admin/realms/{realm}/groups <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52804">#52804</a> Flaky test: org.keycloak.tests.webauthn.registration.passwordless.PwdLessOtherSettingsTest#apiNotAllowedErrorMessage <code>authentication/webauthn</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52831">#52831</a> Disabled organization set on session context during broker login callback <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52913">#52913</a> [quick-theme] Login Page Preview stylesheet URL omits the http-relative-path prefix <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52915">#52915</a> #46367 regression in user provider sync behavior <code>storage</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/52938">#52938</a> Admin UI: IdP organization login switches always persisted as false <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53002">#53002</a> Client roles are not displayed in "Effective role scope mappings" in Client Scope Evaluate <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53013">#53013</a> FGAP v2: creating a user into a group via manage-members + manage-membership also requires the undocumented "view" scope on that group <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53034">#53034</a> GrantTypeCondition misses some event types <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53100">#53100</a> Organizations: malformed domain in login username (e.g. user@example;com) causes unhandled ModelValidationException ('Invalid domain format') <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53106">#53106</a> WARN [io.quarkus.deployment.index.IndexWrapper] (build-44) Failed to index void: Class does not exist in ClassLoader QuarkusClassLoader:Deployment Class Loader: PROD for keycloak@66ce957f <code>dist/quarkus</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53107">#53107</a> SSF discovery document (.well-known/ssf-configuration) omits /realms/{realm} path when realm frontendUrl is set <code>ssf</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53117">#53117</a> signingCertificate handling in v2 <code>admin/api</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53138">#53138</a> MayAct executor rejects valid delegation when the scope parameter is not the exact stored username <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53140">#53140</a> Skips the ClientID binding checks when the claim is not a string <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53154">#53154</a> prompt=none returns login_required for organization members without local credentials when the broker has "Redirect when email domain matches" <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53163">#53163</a> Upgrade migration can attach a stale IdP route to another organization's domain <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53176">#53176</a> Missing manage-organizations permission check for org group mappers <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53188">#53188</a> Single-valued organization mapper emits an attacker-selected non-member organization <code>identity-brokering</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53220">#53220</a> Admin Console user picker (UserSelect) sends username= contains search, producing leading-wildcard LDAP filters that time out on large directories <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53252">#53252</a> Admin UI IdP mapper tests are flaky: clickSaveMapper clicks Cancel before the save request is sent <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53253">#53253</a> IdentityProviderModel removed getOrganizationId() method <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53290">#53290</a> Organization group representations leak client/realm role metadata to unauthorized admins <code>organizations</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/53335">#53335</a> SCIM user PUT/PATCH bypass the user cache: active=false via SCIM does not disable the user for logins <code>scim</code></li> </ul> </div>