services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java:157

• The polling override is only configured in process(). The cooldown path in processAction() returns a freshly rendered verify-email page directly (lines 182–188), so clicking resend before the cooldown expires restores the default polling/check-auth scripts and can reproduce the redirect/error this PR fixes. Configure these attributes through a shared helper that is also applied to that retry response.

        if ("true".equals(authSession.getAuthNote(NEW_USER_REGISTERED))) {
            KeycloakSession session = context.getSession();
            RealmModel realm = context.getRealm();

            // Bounded by the same lifespan as the verification email itself: while that link can still be used,
            // the tab waiting on it can still be told that it worked.
            int expiration = Time.currentTime()
                    + realm.getActionTokenGeneratedByUserLifespan(VerifyEmailActionToken.TOKEN_TYPE);
            String tokenString = session.tokens()
                    .encode(new VerifyEmailSuccessToken(context.getUser().getId(), expiration));

            String pollingUrl = Urls.loginActionsVerifyEmailSuccess(context.getUriInfo().getBaseUri(),
                    realm.getName(), tokenString, authSession.getClient().getClientId(), authSession.getTabId(),
                    AuthenticationProcessor.getClientData(session, authSession)).toString();

            loginFormsProvider.setAttribute("sessionPollingUrl", pollingUrl);
            loginFormsProvider.setAttribute("skipCheckAuthSession", Boolean.TRUE);

tests/base/src/test/java/org/keycloak/tests/forms/RegisterWithEmailVerificationTest.java:482

• This comment now contradicts the production change: registration sessions are deliberately preserved in VerifyEmailActionTokenHandler, not deleted. Update the test explanation so it documents the behavior actually under test.

            // Click the confirm button to actually verify the email. This is the step that:
            //   (a) marks the user's email as verified
            //   (b) DELETES the original auth session that browser 1 is holding

services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java:175

• This recomputes now + lifespan every time the verify-email page is rendered, including ordinary refreshes and cooldown responses, so the polling token can outlive the verification link it accompanies. Persist and reuse the absolute expiry created for the current verification email (and replace it only when a new email is sent) instead of extending it on each render.

        // Bounded by the same lifespan as the verification email itself: while that link can still be used, the
        // tab waiting on it can still be told that it worked.
        int expiration = Time.currentTime()
                + realm.getActionTokenGeneratedByUserLifespan(VerifyEmailActionToken.TOKEN_TYPE);

server-spi-private/src/main/java/org/keycloak/forms/login/LoginFormsProvider.java:82

• Adding this as an abstract interface method breaks existing custom LoginFormsProvider implementations: after an upgrade, this flow invokes a method their compiled classes do not implement and fails with AbstractMethodError. Provide a default implementation using the existing setAttribute/createForm API (or avoid expanding the SPI) so existing providers remain usable.

    Response createVerifyEmailSuccessPage();

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/forms/login/freemarker/FreeMarkerLoginFormsProvider.java:348

• For this detached page, the locale URL builder falls through to getDefaultPageUriForLocale(), which does not preserve the request query. With internationalization enabled, selecting another language therefore drops the signed key (plus client/tab data), and verifyEmailSuccess() redirects away instead of rendering the confirmation; add a LOGIN_VERIFY_EMAIL_SUCCESS locale case that preserves the current request URI/query and cover the language switch.

            case LOGIN_VERIFY_EMAIL_SUCCESS:

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Medium

Comments suppressed due to low confidence (1)

services/src/main/java/org/keycloak/authentication/requiredactions/VerifyEmail.java:202

• The expiry is reused solely because the note exists. If the user's email changes while this page is open, the mismatch at line 142 sends a fresh verification link, but polling keeps the old expiry and can fail before that new link expires; only reuse the expiry when VERIFY_EMAIL_KEY still matches the current email.

        String existing = authSession.getAuthNote(VERIFY_EMAIL_POLLING_EXPIRATION);
        if (existing != null) {
            return Integer.parseInt(existing);

• Files reviewed: 16/16 changed files
• Comments generated: 0 new
• Review effort level: Medium

• Files reviewed: 16/16 changed files
• Comments generated: 1
• Review effort level: Balanced

• Files reviewed: 16/16 changed files
• Comments generated: 0 new
• Review effort level: Balanced