Issues

• CIMD (Client ID Metadata Document): unauthenticated creation of service-account clients from the fetched metadata document

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55106 · Filter by author graziang opened on Nov 12, 2026

• [Quarkus 4] Retarget QOSDK checkout to next branch in quarkus-next workflow

  kind/taskteam/cloud-native
  task

  keycloak/keycloak#55104 · Filter by author Pepo48 opened on Nov 12, 2026
  

• Remove unused UserSessionPersisterProvider#loadUserSessionsStream for startup and the 25.0.0 session migration

  area/infinispankind/eolteam/core-sharedteam/production-readiness
  eol

  keycloak/keycloak#55097 · Filter by author ahus1 opened on Nov 12, 2026
  

• Remove deprecated AuthenticatedClientSessionModel#*CurrentRefreshToken* methods

  area/infinispankind/eolteam/core-sharedteam/production-readiness
  eol

  keycloak/keycloak#55096 · Filter by author ahus1 opened on Nov 12, 2026
  

• Long IDP names do not wrap in Keycloak login buttons

  area/login/uikind/bugstatus/triageteam/core-authn
  bug

  keycloak/keycloak#55093 · Filter by author rawagner opened on Nov 12, 2026

• Remove deprecated EntityDescriptorClientRegistrationProvider Client Registration Provider

  kind/task
  task

  keycloak/keycloak#55091 · Filter by author PadzerButch opened on Nov 12, 2026
  

• Upgrade to Quarkus 3.33.4.2

  area/dist/quarkusbackport/26.6kind/taskteam/cloud-native
  task

  keycloak/keycloak#55087 · Filter by author vmuzikar opened on Nov 12, 2026

• [Keycloak 26.8.2] Admin Console login fails with Invalid parameter: redirect_uri on fresh Windows installation

  area/account/apikind/bugstatus/triageteam/core-shared
  bug

  keycloak/keycloak#55076 · Filter by author caixinyuan opened on Nov 12, 2026
  1

• OIDC identity provider claim filter ignores claims returned by the userinfo endpoint

  keycloak/keycloak#55074 · Filter by author rriski opened on Nov 12, 2026

• FGAP V2: setCredentialUserLabel allows type-agnostic relabeling with RESET_PASSWORD only

  area/admin/apikind/bugpriority/normalteam/core-iamteam/core-shared
  bug

  keycloak/keycloak#55072 · Filter by author abstractj opened on Nov 11, 2026
  

• Security vulnerability report: Keycloak 26.8.1, anonymously registered clients skip the consent page with hidden scopes and mappers, so a signed-in user's code, name and e-mail (and a refresh token) go to the attacker

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55071 · Filter by author abstractj opened on Nov 11, 2026

• Broker LogoutResponse uses RelayState as direct session ID without provider correlation

  area/samlkind/weaknesspriority/importantteam/core-iamteam/core-protocols
  weakness

  keycloak/keycloak#55070 · Filter by author abstractj opened on Nov 11, 2026

• Pairwise mapper sectorIdentifierUri bypasses client URI policies and triggers a server-side GET

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55069 · Filter by author abstractj opened on Nov 11, 2026

• SAML adapter accepts assertion addressed to another ACS when outer Response Destination is absent

  area/samlkind/weaknesspriority/importantseverity/mediumteam/core-protocols
  weakness

  keycloak/keycloak#55068 · Filter by author abstractj opened on Nov 11, 2026

• Expired SAML metadata keys remain trusted after validity ends

  area/samlkind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55067 · Filter by author abstractj opened on Nov 11, 2026

• Expired Signed Request Objects Still Authorize Login

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55066 · Filter by author abstractj opened on Nov 11, 2026

• Browser LogoutRequest bypasses SLO session ownership checks (incomplete fix of #53535)

  area/samlkind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#55065 · Filter by author abstractj opened on Nov 11, 2026

• [CVE-2026-125652] Client-level mandatory PKCE is not applied to authorization codes from the login-actions entry point

  area/authenticationbackport/mainbackport/26.6backport/26.8kind/cvepriority/importantseverity/mediumteam/core-authn
  cve

  keycloak/keycloak#55064 · Filter by author abstractj opened on Nov 11, 2026

• Document and add a skill for writing Liquibase changelog entries that work for both automatic and manual migration

  area/docsarea/storagekind/enhancementstatus/triageteam/core-shared
  keycloak/keycloak#55057 · Filter by author shawkins opened on Nov 11, 2026

• Remove deprecated AdapterInstallationClientRegistrationProvider Client Registration Provider

  kind/task
  task

  keycloak/keycloak#55035 · Filter by author PadzerButch opened on Nov 11, 2026
  

• persian language is missing font and styling

  area/translationshelp wantedkind/enhancementteam/community
  enhancement

  keycloak/keycloak#55023 · Filter by author Soltinator opened on Nov 11, 2026
  1

• CVE-2026-124077 commons-codec:commons-codec

  area/dependenciesbackport/26.8kind/cveseverity/highsource/scan-dependenciesstatus/triage
  cve

  keycloak/keycloak#55022 · Filter by author github-actions opened on Nov 11, 2026

• [Test Framework] Migrate OIDCPublicClientTest.java

  kind/task
  task

  keycloak/keycloak#55017 · Filter by author PadzerButch opened on Nov 10, 2026 · 27.0 Development Milestone
  

• Skip authentication session expiration for realms without authentication sessions

  area/storagebackport/26.8kind/enhancementstatus/labeled-by-botstatus/triageteam/core-sharedteam/production-readiness
  enhancement

  keycloak/keycloak#55015 · Filter by author ahus1 opened on Nov 10, 2026
  

• Skip session expiration of buckets until their earliest possible expiration

  area/storagekind/enhancementstatus/labeled-by-botstatus/triageteam/core-shared
  enhancement

  keycloak/keycloak#55012 · Filter by author ahus1 opened on Nov 10, 2026