Commits

Commits on Jun 4, 2026

Set version to 26.6.3
github-actions[bot]
committed
Added validation to client_session_host (#49682)
msdaly200
authored
[CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint (#49690)
pedroigor
authored
[CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level (#49541) (#49678)
martin-kanis
authored
[CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state (#49686)
pskopek
authored
fix: enforce user profile attribute permissions on group and organization members endpoints (#49555)

pedroigor
and
hoaian412003
authored
fix critical and high CVEs in JavaScript modules (#49596)
edewit
authored
Enforce resource server predicates if one was given despite the IS_ADMIN flag (#48385) (#49668)
pedroigor
authored
External ID should be part of email verification single object key (#49671)
pedroigor
authored
Validate sequence length against the remaining elements in the buffer (#49672)
pedroigor
authored
Revert authentication attempt before invoking realm resource extensions (#49664)
pedroigor
authored

Commits on Jun 3, 2026

Commits on Jun 2, 2026