Issues

• Links to keycloak.org in downstream

  area/docsbackport/26.6backport/26.8kind/bugstatus/triage
  bug

  keycloak/keycloak#53819 · Filter by author andymunro opened on Oct 9, 2026

• A same-named index with the wrong columns is accepted on upgrade, and the index checker stays silent

  area/storagekind/bugstatus/triageteam/core-shared
  bug

  keycloak/keycloak#53818 · Filter by author Benjmhart opened on Oct 9, 2026

• Token refresh: Scope filter can be used to manipulate activation of client policies

  area/authorization-serviceskind/bugpriority/importantteam/core-iamteam/core-protocols
  bug

  keycloak/keycloak#53817 · Filter by author abstractj opened on Oct 9, 2026

• Possible Data Loss Event: Empty SAML NameID causes distinct users to resolve to the same local account and overwrite profile data

  area/samlkind/weaknesspriority/importantteam/core-iamteam/core-protocols
  weakness

  keycloak/keycloak#53816 · Filter by author abstractj opened on Oct 9, 2026
  

• Unverified broker email can satisfy an organization domain gate

  area/identity-brokeringkind/weaknesspriority/importantteam/core-iam
  weakness

  keycloak/keycloak#53815 · Filter by author abstractj opened on Oct 9, 2026
  

• DCR can self-grant  external.token.*  attributes

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#53814 · Filter by author abstractj opened on Oct 9, 2026
  

• [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass

  area/account/uiarea/authenticationbackport/mainbackport/26.6backport/26.8kind/cvepriority/importantteam/core-authnteam/core-shared
  cve

  keycloak/keycloak#53813 · Filter by author abstractj opened on Oct 9, 2026
  

• Unauthenticated SSRF with missing IP-level countermeasures, anonymous confidential-client/service-account self-provisioning, and pre-existing URL-clientId client takeover

  area/oidckind/weaknesspriority/importantteam/core-protocols
  weakness

  keycloak/keycloak#53812 · Filter by author abstractj opened on Oct 9, 2026

• Upgrading from 26.6.1 to 26.8.0 fails with error ldapErrorMissingGroupsPathGroup

  area/ldapkind/bugstatus/auto-expirestatus/missing-informationteam/core-iam
  bug

  keycloak/keycloak#53810 · Filter by author albsol opened on Oct 9, 2026
  2

  

• ISPN000427 timeout on distributed caches when entry lock is contended during topology change

  area/infinispankind/bugstatus/labeled-by-botstatus/triageteam/production-readiness
  bug

  keycloak/keycloak#53809 · Filter by author ahus1 opened on Oct 9, 2026
  

• [Translations] Add missing German translations (Admin UI) via AI

  kind/task
  task

  keycloak/keycloak#53807 · Filter by author robson90 opened on Oct 9, 2026

• Missing detailed audit information in realm role delete operation

  area/admin/uikind/bugstatus/triageteam/core-iam
  bug

  keycloak/keycloak#53806 · Filter by author flores67 opened on Oct 9, 2026
  

• Operator Helm chart renders null version labels because Chart.yaml lacks appVersioN

  area/operatorkind/bugstatus/triageteam/cloud-native
  bug

  keycloak/keycloak#53804 · Filter by author jkleinlercher opened on Oct 9, 2026

• Client registration policy to restrict the grant types of dynamically registered clients

  kind/enhancementstatus/labeled-by-botstatus/triage
  enhancement

  keycloak/keycloak#53793 · Filter by author peterekhator opened on Oct 9, 2026

• Align JBoss EAP and WildFly SAML adapter

  kind/task
  task

  keycloak/keycloak#53781 · Filter by author jfdenise opened on Oct 9, 2026

• Old testsuite on embedded Undertow: second server start in a JVM fails with "Invalid jboss.server.data.dir"

  area/testsuitekind/bugstatus/labeled-by-botstatus/triageteam/continuous-delivery
  bug

  keycloak/keycloak#53771 · Filter by author dasniko opened on Oct 9, 2026

• Flaky test: org.keycloak.testsuite.adapter.servlet.SAMLServletAdapterTest#employeeSigPostNoIdpKeyTestCertSubjectAsKeyNameInKeyInfo

  area/testsuitekind/bugstatus/labeled-by-botstatus/triageteam/continuous-delivery
  bug

  keycloak/keycloak#53769 · Filter by author dasniko opened on Oct 8, 2026

• Use an email input for the username field when the email is the username

  kind/enhancementstatus/triage
  enhancement

  keycloak/keycloak#53768 · Filter by author tbal opened on Oct 8, 2026

• [OID4VCI] jwt vc issuer jwks_uri is dereferenced without the https requirement applied to the issuer

  area/oid4vckind/bugstatus/labeled-by-botstatus/triageteam/core-protocols
  bug

  keycloak/keycloak#53762 · Filter by author naruto-lgtm opened on Oct 8, 2026

• CVE-2026-107604: Incomplete fix for CVE-2026-89298 - view-clients role allows client secret retrieval via installation providers

  area/oidcbackport/mainbackport/26.6backport/26.8kind/cvepriority/importantseverity/mediumteam/core-protocols
  cve

  keycloak/keycloak#53751 · Filter by author abstractj opened on Oct 8, 2026
  

• CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout

  area/oidcbackport/mainbackport/26.6backport/26.8kind/cvepriority/importantseverity/mediumteam/core-protocols
  cve

  keycloak/keycloak#53749 · Filter by author abstractj opened on Oct 8, 2026
  

• Admin Console duplicates role-mapping endpoints in ui-ext with diverging permission checks

  area/admin/fine-grained-permissionsarea/admin/rbacarea/admin/uikind/taskteam/core-iam
  keycloak/keycloak#53747 · Filter by author pedroigor opened on Oct 8, 2026

• kc.sh build output is not reproducible

  help wantedkind/bugpriority/lowstatus/auto-bumpstatus/auto-expireteam/cloud-native
  bug

  keycloak/keycloak#53744 · Filter by author martinohansen opened on Oct 8, 2026
  2

• Expose the validated redirect URI to OAuth consent templates

  kind/enhancementstatus/triage
  enhancement

  keycloak/keycloak#53743 · Filter by author lilianmisser-dg opened on Oct 8, 2026
  1

• Disabled organizations are still listed on the "select organization" login page

  area/organizationshelp wantedkind/bugpriority/normalstatus/auto-bumpstatus/auto-expireteam/core-iam
  bug

  keycloak/keycloak#53736 · Filter by author LukasSchwaiger opened on Oct 8, 2026
  2