The Keycloak Team reports:
- [CVE-2026-15943]: OIDC identity provider update reuses masked client secret after token URL changes.
- [CVE-2026-18569]: OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled.
- [CVE-2026-82968]: Persistent wrong-account linking through null / GitHub identity provider.
- [CVE-2026-94001]: Admin credential DELETE bypasses denied reset-password permission.
- [CVE-2026-94000]: A delegated admin with only `manage-users` can become `realm-admin` by joining (or being created into) a group that maps an admin role.
- [CVE-2026-94218]: 2FA setup enforcement bypass via /realms/{realm}/login-actions/restart — #YWH-PGM40475-254
- [CVE-2026-94215]: Cross-realm realm resource read/write via per-request session-level cache in RealmCacheSession.
- [CVE-2026-94213]: Missing user view authorization in the Authorization Services policy evaluation endpoint, possible incomplete fix of CVE-2026-37978.
- [CVE-2026-94217]: UMA scope merge across resource owners via name collision in resolveResourcePermission.
- [CVE-2026-96446]: Security vulnerability in Keycloak 26.7.3 — PAR single-use bypass via prompt=none.
- [CVE-2026-96445]: Conditional OTP trusts skip headers on untrusted proxy paths.
- [CVE-2026-97177]: Generic user update bypasses denied reset-password permission.
- [CVE-2026-95503]: Potential KDC spoofing attack when Kerberos password authentication is enabled.
- [CVE-2026-97311]: Broken access control in Admin REST API: roles/{role-name}/groups discloses groups the caller cannot view (incomplete fix of the 26.7.2 hardening).
- [CVE-2026-97846]: Standard Token Exchange bypasses required mTLS certificate binding and issues an active bearer token when no client certificate is supplied.
- [CVE-2026-101333]: Unbounded metric series creation via idp tag on broker login endpoint.
- [CVE-2026-91777]: Third-party dependency fix, com.fasterxml.jackson.core:jackson-databind
- Multiple CVEs in third-party dependency tools.jackson.core:jackson-databind
- [CVE-2026-103884]: Path traversal via X.509 CRL Distribution Point - client-supplied CRL path escapes $KC_HOME/conf
- Multiple CVEs in third-party dependency simple-git.
- Flaky test: initial-access.spec.ts 'Initial access token' fails with TypeError on table data read.
- [CVE-2026-107121]: SMTP starttls=true permits plaintext credential and message downgrade.