Commits

History for

Commits on Aug 10, 2026

[CVE-2026-16072] Organization managers can create managed members through stored registration links without manage-users

martin-kanis
authored and
pedroigor
committed
60967c8
Add event detail when using rotated password to authenticate the client

rmartinc
authored and
pedroigor
committed
1b11950
Enable signature validation when metadata KeyDescriptor has no use attribute

sguilhen
authored and
pedroigor
committed
5ec9805
Enforce link-only restriction on SAML IdP-initiated broker login

sguilhen
authored and
pedroigor
committed
4e18ea7
Add test coverage for search query escape handling edge cases

sguilhen
authored and
pedroigor
committed
bc4418d
Reject unterminated escape sequences in SearchQueryUtils.getFields()

Pons3006
authored and
pedroigor
committed
940f1e6
Fix organization creation when domain field is empty

sguilhen
authored and
pedroigor
committed
6f00db3
Closes #50903, added length check for username (#51129)
msdaly200
authored
0e728be
Skip unnecessary provider initialization for non-server commands (#51511)
mabartos
authored
bc4b813

Commits on Aug 7, 2026

Commits on Aug 6, 2026

CVE-2026-16100 Prevent OOM via request-controlled error text metrics explosion

ahus1
and
Copilot
authored
a569ef5

Commits on Aug 5, 2026

introduce a new keycloak admin client based on jackson 3 (#50848)
michalvavrik
authored
c1cfde7

Commits on Aug 4, 2026

fix(admin/api): allow non-master realm roles named admin or create-realm

alehhu
authored and
pedroigor
committed
f38c16b

Commits on Aug 3, 2026

Fix verify email at multiple places. (#50946)
gaoyikeshuer
authored
3ce2c51
[OID4VP] Add Cross-Device Flow support
dominikschlosser
authored
3a7c359

Commits on Jul 31, 2026

Commits on Jul 30, 2026

Gracefully handle disabled or removed IdP during logout

andrew2k4
authored and
pedroigor
committed
031fbe2
[OID4VCI] Ensure credential configuration IDs are unique (#51272)
forkimenjeckayang
authored
1550152
fix: namespace OID4VCI credential offer cache keys by realm

Awambeng
authored and
mposolda
committed
c0395ab
[OID4VCI] User-editable did attribute used as credential subject with realm-local uniqueness only

tdiesler
authored and
mposolda
committed
0ac222f
[CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets (#51209)
mabartos
authored
4e1c2ad

Commits on Jul 29, 2026

Commits on Jul 28, 2026

Group hierarchy search discloses hidden parent groups under FGAP v2

vramik
authored and
pedroigor
committed
55b56bc