Commits

Breadcrumbs

History for

onmain

User selector

All users

All time

Commit History

Commits on Jun 19, 2026

• fix: Identity providers should not be hidden from login page when the user goes back from the reset credentials page (#48814)

  Show description for 72c3f6c
  

  vilmosnagy

  and

  claude

  authored
  72c3f6c

  Copy full SHA for 72c3f6c

Commits on Jun 18, 2026

• Reject redirect URIs containing pre-loaded OIDC response parameters (#49959)

  Show description for 18832bc
  jimmychakkalakal

  authored
  18832bc

  Copy full SHA for 18832bc

Commits on Jun 17, 2026

• [OID4VCI-FAPI2] Pass fapi2-security-profile-final-ensure-response-type-code-idtoken-fails

  Show description for 96160a1
  

  tdiesler

  authored and

  mposolda

  committed
  96160a1

  Copy full SHA for 96160a1

Commits on Jun 16, 2026

• Stop cookie-based SSO re-auth from resetting brute-force counter (#49996)

  Show description for ed270d9
  niels-van-nerum

  authored
  ed270d9

  Copy full SHA for ed270d9

• Rename discoverable key as discoverable credential (#50016)

  Show description for e7f0157
  gaoyikeshuer

  authored
  e7f0157

  Copy full SHA for e7f0157

Commits on Jun 15, 2026

• Add residentKey WebAuthn policy option. Closes #42513 (#49687)

  Show description for 31cf0d5
  gaoyikeshuer

  authored
  31cf0d5

  Copy full SHA for 31cf0d5

Commits on Jun 12, 2026

• Propagate cluster events via a new database table for cacheless

  Show description for e387354
  ahus1

  authored
  e387354

  Copy full SHA for e387354

• DefaultLocaleUpdaterProvider: KEYCLOAK_LOCALE cookie not set for READ_ONLY federated users

  Show description for 77c398e
  

  2 peopleauthored and

  pedroigor

  committed
  77c398e

  Copy full SHA for 77c398e

• Move AuthorizationCodeTest to the new testsuite (#49772)

  Show description for eb85945
  lhanusov

  authored
  eb85945

  Copy full SHA for eb85945

Commits on Jun 11, 2026

• Fix CIBA bypassing brute force protection (#49791)

  Show description for 11c2695
  jimmychakkalakal

  authored
  11c2695

  Copy full SHA for 11c2695

Commits on Jun 10, 2026

• Add per-mapper UUID attribute decoding toggle for Group LDAP mapper

  Show description for 512331e
  

  sguilhen

  authored and

  pedroigor

  committed
  512331e

  Copy full SHA for 512331e

• Add per-mapper binary attribute decoder config for LDAP user attributes

  Show description for 0991605
  

  sguilhen

  authored and

  pedroigor

  committed
  0991605

  Copy full SHA for 0991605

• Moved LoginTest to the new testsuite (#48522)

  Show description for a485bba
  jimmychakkalakal

  authored
  a485bba

  Copy full SHA for a485bba

Commits on Jun 9, 2026

• Optimize SQL statements and transactions for cacheless profile

  Show description for 0d17380
  ahus1

  authored
  0d17380

  Copy full SHA for 0d17380

• [OID4VCI-FAPI2] Pass fapi2-security-profile-final-state-only-outside-request-object-not-used (#49788)

  Show description for 9b6cb28
  tdiesler

  authored
  9b6cb28

  Copy full SHA for 9b6cb28

• Add kid to CLIENT_LOGIN event of Signed JWT auth

  Show description for 146e52e
  timhallmann

  authored
  146e52e

  Copy full SHA for 146e52e

• Check if organizations is enabled when processing token responses

  Show description for f0f2654
  pedroigor

  committed
  f0f2654

  Copy full SHA for f0f2654

• Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

  Show description for 3c2b120
  pedroigor

  committed
  3c2b120

  Copy full SHA for 3c2b120

• Remove sshd-core dependency (#49781)

  Show description for 7ab5e2b
  stianst

  authored
  7ab5e2b

  Copy full SHA for 7ab5e2b

Commits on Jun 8, 2026

• OIDC bearer-only legacy clients should be allowed to have client secret

  Show description for fd275eb
  mposolda

  committed
  fd275eb

  Copy full SHA for fd275eb

• More flexibility for client policies in identity-broker-api:v2 (#49695)

  Show description for e1b9acf
  mposolda

  authored
  e1b9acf

  Copy full SHA for e1b9acf

Commits on Jun 5, 2026

• Check CA subject DN in X.509 client authenticator (#48550)

  Show description for af717f7
  rmartinc

  authored
  af717f7

  Copy full SHA for af717f7

Commits on Jun 4, 2026

• Store login failures in the database

  Show description for 4517efd
  

  pruivo

  and

  ahus1

  authored
  4517efd

  Copy full SHA for 4517efd

• [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state

  Show description for dba79eb
  

  pskopek

  authored and

  mposolda

  committed
  dba79eb

  Copy full SHA for dba79eb

• Ability to add parameterized scope type (#49420)

  Show description for e158565
  mabartos

  authored
  e158565

  Copy full SHA for e158565

• [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level (#49541)

  Show description for f19e1f2
  martin-kanis

  authored
  f19e1f2

  Copy full SHA for f19e1f2

• Add validation for LDAP Connection URL when multiple LDAP URLs are provided.

  Show description for 67368e3
  

  sguilhen

  authored and

  pedroigor

  committed
  67368e3

  Copy full SHA for 67368e3

Commits on Jun 3, 2026

• Store single use objects in the database

  Show description for f7c442a
  pruivo

  authored
  f7c442a

  Copy full SHA for f7c442a

• Create SPI to store revoked tokens

  Show description for c2975de
  pruivo

  authored
  c2975de

  Copy full SHA for c2975de

• Added validation to client_session_host

  Show description for 4b1c114
  msdaly200

  authored
  4b1c114

  Copy full SHA for 4b1c114

• ROPC Grant Policy Bypass for reject-ropc-grant

  Show description for 13622ee
  mposolda

  committed
  13622ee

  Copy full SHA for 13622ee

Commits on Jun 2, 2026

• Fix by only add Verify_email required action when user has an email. Closes #48634 (#49574)

  Show description for b8f7fec
  gaoyikeshuer

  authored
  b8f7fec

  Copy full SHA for b8f7fec

• New tests cleanup - ExportImport tests use duplicated json objects. (#49591)

  Show description for 5c64e04
  lhanusov

  authored
  5c64e04

  Copy full SHA for 5c64e04

• [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint

  Show description for 461ce79
  pedroigor

  authored
  461ce79

  Copy full SHA for 461ce79

• External ID should be part of email verification single object key

  Show description for 37dabf5
  pedroigor

  authored
  37dabf5

  Copy full SHA for 37dabf5