Release Notes

[5.1] - 2026-08-11

Keycloak version

• 26.7.2

Fixed

CVE Security Fixes: 11

Critical: 1

• CVE-2026-18963: Unauthenticated account takeover via reset-credentials flow bypass (CVSS-Score: 9.1)

Breaking changes

• Legacy client-initiated account linking endpoint disabled by default - source
• Client scope assignment now also requires manage permission on client scopes (in addition to manage on the client) - source
• Admin roles granted only via protocol mappers no longer grant Admin API access - must be directly assigned via role/group membership - source
• Identity Provider alias is now immutable after creation - source
• Organization member query (GET .../organizations/{id}/members) returns brief user representation by default (?briefRepresentation=false for full) - source
• X509 client authentication now requires a configured CA Subject DN - source
• view-system admin role removed - full server info now requires master realm + manage-realm - source

Official Release Notes

• 26.7.2
• 26.7.1
• 26.7.0

[5.0] - 2026-07-02

Keycloak version

• 26.6.4

Fixed

CVE Security Fixes: 39

Critical: Keine

Breaking changes

• Stricter SAML SubjectConfirmationData validation - NotBefore, NotOnOrAfter, and Recipient in bearer SAML confirmations are now enforced; only affects realms using SAML identity brokering (introduced 26.5.4) - source
• JavaScript-based authorization policies now require the scripts feature flag explicitly enabled (26.6.0) - source
• secure-client-uris policy executor now enforces HTTPS on Post-logout redirect URI, Logo URL, Policy URL, and Terms of Service URL (26.6.0) - source
• Identity Provider issuer must now be unique when used for JWT Authorization Grant / client assertions (26.6.0) - source
• Outgoing HTTP connections from Keycloak no longer follow redirects by default (26.6.1) - source
• Client scope evaluation now requires view-users access on the target user (26.6.1) - source
• If migrating directly from 26.5.x to 26.6.1+, an “Organization” sub-flow may be auto-inserted into custom browser flows - review and remove if not desired - source
• Token introspection now validates that the caller is present in the token’s aud claim (26.6.2) - source
• UserInfo endpoint rejects lightweight access tokens (401) by default (26.6.2) - source
• Redirect URI wildcards no longer match across the hostname (e.g. https://example.com* no longer catches arbitrary subdomains) (26.6.3) - source
• User profile metadata dropped from bulk user-search results, still available on single-user fetch (26.6.3) - source
• Java Keystore provider files must now live under a fixed per-realm directory (26.6.4) - source

Official Release Notes

• 26.6.4
• 26.6.3
• 26.6.2
• 26.6.1
• 26.6.0
• 26.5.7
• 26.5.6
• 26.5.5
• 26.5.4

[4.1] - 2026-02-16

Keycloak version

• 26.5.3

Fixed

• Security patch - 3 CVEs in the JWT Authorization Grant and organization invitation flow

[1.2.0] - 2024-11-11

Added

• Keycloak 26 Single Instance with PostgreSQL 16 DB backend

Deprecated

• Keycloak 25

[1.1.0] - 2024-08-07

Added

• Keycloak 25 Single Instance with PostgreSQL 16 DB backend
• Support for DNS custom domains

[1.0.0] - 2024-03-13

Added

• Keycloak 23 Single Instance with PostgreSQL 15 DB backend