Last 7 days
1
Features: 0
Changes: 0
Fixes: 1
Deprecations: 0
Keycloak
Open-source identity and access management for applications and services.
Latest Keycloak changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Keycloak release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Keycloak updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
Keycloak updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
1
2
5
25
Latest Keycloak changelog updates
Patched multiple critical CVEs (OpenTelemetry memory allocation, admin permission bypass, Jackson upgrade, group hierarchy disclosure, vault secret leak, account linking hash, reset credentials bypass) and fixed a config leak of the vaul...
Security patches address CVE‑2026‑9793 (JWE request object enforcement), CVE‑2026‑4629 (hard‑coded role mapper injection), CVE‑2026‑14209 (admin UI brute‑force), and two fine‑grained admin permission bypasses (client scope and group chil...
Added preview SCIM API for automated user provisioning, multi‑cluster HA without external caches, and step‑up authentication for SAML clients.
Multiple critical security fixes addressing CVEs (group admin escalation, filesystem path disclosure, XSS, token misuse, privilege escalation, authorization bypass, JWT algorithm confusion)
Addressed numerous security vulnerabilities (CVE‑2026‑4800, 2026‑4874, 2026‑37977, 2026‑7500, 2026‑42581, 2026‑8922, 2026‑8830, 2026‑9088, 2026‑9087, 2026‑9802, 2026‑9794, 2026‑9791, 2026‑0707, 2026‑9801, 2026‑9704, 2026‑9792) covering c...
Fixed numerous security vulnerabilities (CVE-2026-33871, CVE-2026-33870, CVE-2026-4628, CVE-2026-37980, CVE-2026-5588, CVE-2026-6856, multiple Bouncy Castle CVEs, CVE-2026-7307, CVE-2026-7504, CVE-2026-7571, CVE-2026-7507, CVE-2026-37982...
Fixed two critical security issues (CVE‑2026‑4366 SSRF and CVE‑2026‑4633 user enumeration)
Added supported JWT Authorization Grant and Federated client authentication for external token exchange and client assertions.
Applied several security patches for CVEs, fixing improper access control, DoS, path traversal, privilege escalation, and UMA policy injection issues.
Multiple security patches (CVE‑2026‑1180, CVE‑2026‑1035, CVE‑2025‑14777, CVE‑2025‑14082, CVE‑2026‑3121, CVE‑2026‑3190, CVE‑2026‑3911, CVE‑2026‑2366) fix SSRF, token‑reuse, IDOR, privilege escalation and information‑disclosure issues.
Fixed several SAML broker security vulnerabilities (CVE‑2026‑3047, CVE‑2026‑3009, CVE‑2026‑2603, CVE‑2026‑2092) that allowed authentication bypass and improper IdP handling.
Security patches resolve multiple CVEs affecting SAML handling, auth‑header parsing, DoS via SAMLRequest decompression, and disabled‑client checks.
Security patches fix CVE‑2026‑1609, CVE‑2026‑1529, CVE‑2026‑1486, and CVE‑2025‑14778 related to JWT authorization and UMA policy checks.
Security fixes address CVE‑2025‑67735 (Netty request smuggling), CVE‑2025‑66560 (Quarkus REST thread exhaustion) and CVE‑2025‑14559 (unauthorized token issuance for disabled users).
Added full realm management from the master realm without requiring a global admin role
Preview features added: JWT Authorization Grant, Workflows for realm automation, federated client authentication using Kubernetes service‑account tokens, and a new USER SESSION DELETED event.
Added documentation warning for printing headers in HTTP access logs and upgraded the runtime to Quarkus 3.27.1.
Adds LDAP referral filtering by default, improving security best practices.
Fixed multiple bugs including flaky broker OTP test, missing artifact docs, invalid Liquibase checksum, email persistence with "email as username", import migration handling, group policy role assignment, attribute ordering side‑effects,...
Added ability to hide client scopes in the discovery endpoint, introduced a rate limiter for verification‑email updates, and enabled role‑based authorization for workflows.
Updated email documentation, made pending email verification attribute removable by admin, and added SPIFFE support for OIDC JWK endpoint
Secure Client Initiated Renegotiation is now disabled by default in the Quarkus distribution, enhancing security.
Introduced passwordless Passkeys, full DPoP support (including refresh‑only binding) and FAPI 2 final compliance, strengthening security.
Upgrade to Quarkus 3.20.3 LTS and drop explicit MariaDB connector dependency.
Updated to Quarkus 3.20.2.2 and added a multithreading double‑check for SAST.
Updated cache owners, Infinispan to 15.0.19.Final, and Quarkus to 3.20.2.1.
Added OIDC IdP option “Requires short state parameter”.
Upgrade to Infinispan 15.0.16.Final and refine preview rolling‑update limitations.
Added 2FA recovery codes as a supported feature for account recovery;
Improved Infinispan session handling: lazy mapping of sessions for Admin UI, faster session list retrieval, and reduced client session loading latency.
Add documentation clarifying when to use podman for Keycloak deployments
Added ability to log details and representation to the JBoss logging listener
Make distribution startup timeout configurable
Clarified upgrade instructions and updated docs for Grafana dashboard titles and Operator auto‑update strategy.
Added Standard Token Exchange (RFC 8693) support and dynamic authentication flow selection via client policies.
Upgrade to Quarkus 3.15.4 (runtime platform update).
Added admin UI option to disable automatic refresh of event views
Added "only federated" option to Reset Credential Email authenticator, making forced login after reset the default for federated users.
Dropped support for end‑of‑life Node.js versions (deprecation)
Added a default-enabled X.509 authenticator option to abort login when the configured CRL is not up-to-date, enhancing certificate validation security.
Default cluster node discovery now uses JDBC ping, deprecating the UDP transport stack for easier cloud deployment.
Added a dedicated User Events tab in client/user details and enabled autocomplete for the username field in the login UI.
Documentation updates: refreshed Authorization Services guide, addressed QE comments in Server Administration guide, fixed typos, and clarified caching docs.
Admin events now include a DETAILS JSON column, requiring a DB schema update during upgrade.
LDAP users are now created as enabled by default when provisioning through Microsoft Active Directory, aligning behavior with other user storages.
Updated Keycloak admin client for future server compatibility
Enhancement: Truststore path can now be fully specified when configuring trusted certificates.
Clarified behavior for multiple Operator versions in the same cluster and added better logging for transaction commit errors.
Organizations feature fully supported and client libraries now have independent release cycles with broader server compatibility.
Resolved numerous bugs including locked‑user re‑enable attribute loss, Remember‑Me with external Infinispan, WebAuthn login flow errors, hostname path restrictions, admin client @NoCache annotation, realm import default ACR handling, LDA...
Fix SAML adapter IdMapperUpdaterSessionListener not running when session IDs change
Upgrade Infinispan to version 15.0.7.Final
Fixed numerous UI and backend bugs including authBaseUrl errors, LDAP sync issues, client secret rotation display, and token expiration handling.
Added a proper FreeMarker template for the new consoles and enhanced masking around the config keystore
Added Java 21 support, deprecated Java 17, and removed most Java adapters, requiring migration to newer libraries.
Fixed a critical security vulnerability in PAR flow for OIDC confidential clients using client_secret_post authentication; rotate client secrets after upgrade.
Removed support for partial updates of user attributes (username, email, firstName, lastName) via the Admin User API – full payload now required.
Fix LDAP/MSAD account propagation and allow disabling LDAP‑backed users when importEnabled=false.
Upgrade to Quarkus 3.8.3 and Infinispan 14.0.27 with related operator/CR improvements
Operator mistakenly deployed the nightly container instead of 24.0.0, resulting in an incorrect migration version (999.0.0).
User profile is now fully supported with fine‑grained attribute control, dynamic forms, validators, annotations and progressive profiling; migration is smooth but the User Profile SPI introduces breaking changes.
Reduced offline session cache entry lifespan in memory
Fixed Operator CSV createdAt field format (issue #26427)
Provides upgrade instructions for version 23.0.5.
Consult the migration guide before upgrading to version 23.0.4.
Provides upgrade guidance with a link to the migration guide.
Added non‑blocking `/lb-check` health endpoint (requires the multi‑site feature) for responsive load‑balancer checks under load.
Fixed several LDAP and admin UI bugs, including undefined property errors, greyed‑out unlink option, group search, and proper handling of 400 errors.
Added new FAPI 2 client profiles, DPoP preview support, and passkeys/WebAuthn enhancements for stronger authentication.