Keycloak 26.8.1 Security Sweep: What the Patch Release Lists After 26.8.0

An identity server is a component whose bugs can turn directly into account takeover. The 26.8.1 release notes are dominated by access-control and authentication issues. The 26.8.0 release notes describe the new capabilities. This article reads the two together and states only what each page says. It does not infer when any issue was introduced or whether it affects earlier versions.

Key changes at a glance #

Fine-grained admin permissions: the largest cluster #

The 26.8.1 notes list several issues in the admin/fine-grained-permissions area. One states that a delegated admin with only manage-users can become realm-admin by joining, or being created into, a group that maps an admin role (#53060). Two others describe bypasses of a denied reset-password permission: via admin credential DELETE (#53057) and via the generic user update (#53158). A weakness entry covers custom role injection through oidc-hardcoded-role-mapper, noted as an incomplete fix for an earlier CVE (#53417). Another says non-imported LDAP users were returned in search results for query-users-only delegated admins (#53693).

The common theme is that a delegation boundary holds only if every code path enforces it. If you use delegated administration, it is reasonable to review which groups carry admin role mappings and who can edit group membership.

Brokering, OIDC and SAML #

For identity brokering, 26.8.1 lists an OIDC identity provider update that reuses a masked client secret after token URL changes (#50945), persistent wrong-account linking through a null GitHub identity (#52321), and a regression with Trust Email when the userinfo endpoint is used (#53471). The OIDC broker backchannel logout item says unsigned forged logout tokens were accepted when signature validation is disabled (#51381).

The SAML entries are blunt. One covers unauthenticated arbitrary session termination via LogoutRequest SessionIndex (#53116). Another says the query-string signature was verified over a different SAMLResponse than the one processed, because of the ';' parameter separator, allowing unauthenticated login as an arbitrary user (#53354). If you broker SAML with the HTTP-Redirect binding, this entry is a strong reason to prioritize the upgrade.

On the OIDC side, 26.8.1 also lists a PAR single-use bypass via prompt=none (#53111) and a refresh-versus-revoke race in strict mode where revokeRefreshToken=true (#51312).

Token exchange: described in 26.8.0, with fixes listed in 26.8.1 #

The 26.8.0 notes describe token exchange delegation as preview. Users delegate access to a client through consent using a parameterized scope of the form delegation:client:<client-id>, and the resulting token carries an act claim. Delegation authorization is controlled through Fine-Grained Admin Permissions V2 with the delegate and delegate-members scopes, and a new client policy executor can restrict the may_act claim. The notes also say client delegation does not grant Admin API access even if the client holds service account credentials.

The 26.8.1 notes then list a Standard Token Exchange bypass of required mTLS certificate binding, issuing an active bearer token when no client certificate was supplied (#53187). They also list a bug where token introspection omits the act claim for token-exchange delegation tokens (#53029), and one where client sessions attached to offline user sessions via token exchange are created with OFFLINE_FLAG=0 (#52139). Teams adopting delegation for agents should read these entries, because they concern audit and session behavior.

Authentication, transport and dependencies #

• 2FA setup enforcement bypass via the login-actions restart path (#53070), and Conditional OTP trusting skip headers on untrusted proxy paths (#53112).
• Potential KDC spoofing when Kerberos password authentication is enabled (#53159), and Kerberos TRACE logging recording complete SPNEGO credentials (#52680).
• Path traversal via a client-supplied X.509 CRL Distribution Point path escaping the conf directory under KC_HOME (#53419).
• SMTP starttls=true permitting plaintext credential and message downgrade (#53674).
• Cross-realm resource read/write through the per-request cache in RealmCacheSession (#53071).
• Unbounded metric series creation via the idp tag on the broker login endpoint (#53338), plus jackson-databind and simple-git dependency CVEs.

Opt-in protection from 26.8.0 #

The 26.8.0 notes introduce the secure-client-node-hostname client policy executor to protect against SSRF via the legacy adapter node registration endpoint. The notes state that the protection is opt-in and must be explicitly configured. When attached to a client policy, it validates node hostnames against administrator-configured regex patterns, and registrations that match none are rejected. Port suffixes are always rejected, and patterns match the bare hostname or IP address.

The same release also promotes OID4VCI, parameterized scopes and Client Admin API v2 to preview, and Client Secret Rotation to supported. It adds OID4VP as experimental. The 26.8.0 notes say OID4VCI can be enabled with --features=preview or --features=oid4vc-vci, and Client Admin API v2 with --features=preview or --features=client-admin-api:v2.

Operational bugs worth noting #

Several 26.8.1 bug and weakness entries affect clustering and sessions. They include a JGroups certificate reload blocking the view handling thread (#53824), JGroups TCP sends to healthy nodes blocked by an unreachable node when virtual threads are disabled (#53825), and rotated-out client JWKS keys and CRLs staying valid on all but one node because the keys cache invalidation event had no listener (#53430). The Admin Console sign-out issue, where signing out one session logged out an unrelated session for the same user, is #52927.

Upgrade checklist #

1. Read the migration guide that the 26.8.1 notes point to, plus the upgrading guide referenced in the 26.8.0 notes.
2. Inventory exposure: SAML brokers, delegated admins, token exchange, Kerberos, X.509 CRLs and SMTP settings.
3. Back up the database and realm configuration before upgrading.
4. Target 26.8.1 if moving to the 26.8 line, since its notes carry the fixes listed above.
5. After upgrading, test SAML broker login and logout, OIDC backchannel logout, and refresh token revocation.
6. Re-verify delegated admin boundaries: group role mappings, reset-password denial and role mappers.
7. If you use token exchange, re-test your certificate-bound clients and your delegation tokens against the entries above.
8. Confirm your SMTP and Kerberos configuration against the entries above.
9. If you use legacy node registration, add the secure-client-node-hostname executor to a client policy.