26.7.1
📦 keycloakView on GitHub →
🐛 11 fixes🔧 8 symbols
Summary
This release addresses several security vulnerabilities and bug fixes, including issues related to JWE request objects, privilege escalation, admin UI extensions, fine-grained permissions, WebAuthn, clustering, and password resets.
Migration Steps
- Refer to the migration guide for a complete list of changes.
🐛 Bug Fixes
- JWE request object bypasses requestObjectSignatureAlg enforcement (CVE-2026-9793).
- Privilege escalation via hardcoded role mapper injection in manage-clients (CVE-2026-4629).
- Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 (CVE-2026-14209).
- Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment (CVE-2026-14614).
- FGAP v2 parent group children endpoint bypasses per-child view permission filter (CVE-2026-14615).
- WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field.
- Clustering test broken in 26.7 release branch.
- Kustomize cluster-wide faulty Role&RoleBinding.
- New Password is committed when multiple Password Reset is detected.
- 500 when client requests `organization` scope with it already set to `Default`.
- IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion.