{"full_name":"keycloak/keycloak","owner":"keycloak","name":"keycloak","url":"https://github.com/keycloak/keycloak","description":"Open Source Identity and Access Management For Modern Applications and Services","homepage":"https://www.keycloak.org","topics":[],"language":"Java","license":"Apache-2.0","avatar":"https://avatars.githubusercontent.com/u/4921466?v=4","created_at":"2013-07-02T13:38:51Z","pushed_at":"2026-11-10T06:30:56Z","metrics":{"stars":37783,"forks":9167,"watchers":403,"issues":21184,"prs":27051,"releases":118,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":5601},"growth":{"day":{"stars":16,"forks":5,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[37767,37783],"forks":[9162,9167],"watchers":[403,403],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":30180,"title":"Keycloak Organizations","comments":126,"created_at":"2024-06-05T19:27:39Z"},{"number":8742,"title":"Trusted Device two factor authenticator","comments":63,"created_at":"2021-11-09T10:51:58Z"},{"number":10250,"title":"Ability to continue with \"browser\" authentication flow after Identity provider login","comments":55,"created_at":"2022-02-16T09:49:38Z"},{"number":13484,"title":"SCIM support","comments":50,"created_at":"2022-08-02T10:40:35Z"},{"number":33800,"title":"when it fails to export realm with docker container","comments":48,"created_at":"2024-10-11T00:28:00Z"},{"number":10655,"title":"Impersonate does not work with separate admin hostname","comments":47,"created_at":"2022-03-08T19:52:06Z"},{"number":12454,"title":"User ID ignored during user creation using the REST API","comments":46,"created_at":"2022-06-09T20:02:21Z"},{"number":10816,"title":"Read secrets from files","comments":42,"created_at":"2022-03-18T10:10:42Z"}],"discussions":[{"number":54782,"title":"How to show the organization list only after the password step?","comments":1,"category":"Q&A","created_at":"2026-11-06T16:59:00Z"},{"number":54760,"title":"CVE-2026-117691 Mitigation available","comments":1,"category":"Q&A","created_at":"2026-11-06T13:53:06Z"},{"number":54686,"title":"Session Limit Blocks Login","comments":1,"category":"Q&A","created_at":"2026-11-05T15:06:18Z"},{"number":54659,"title":"Looking for guidance on a clean self-service MFA and recovery code design","comments":1,"category":"Q&A","created_at":"2026-11-04T21:40:06Z"},{"number":54628,"title":"Login themes: near-term FreeMarker extensibility vs longer-term Authentication UI API","comments":0,"category":"Ideas","created_at":"2026-11-04T09:22:11Z"},{"number":54611,"title":"SCA and Credential Management UI: Keycloakify or External Frontend?","comments":1,"category":"Q&A","created_at":"2026-11-03T21:33:40Z"},{"number":54581,"title":"Why are Admin Events not generated when modifying Realm Localization Overrides?","comments":1,"category":"Q&A","created_at":"2026-11-03T12:54:03Z"},{"number":54483,"title":"Integrating external SCA APIs into the browser flow","comments":2,"category":"Q&A","created_at":"2026-10-30T12:40:10Z"}],"latest_release":{"name":"26.8.2","tag":"26.8.2","published_at":"2026-11-05T16:00:19Z","body":"<div>\n\n<h2>Upgrading</h2>\n<p>Before upgrading refer to <a href=\"https://www.keycloak.org/docs/latest/upgrading/#migration-changes\">the migration guide</a> for a complete list of changes.</p>\n\n<h2>All resolved issues</h2>\n\n<h3>Security fixes</h3>\n<ul>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/53061\">#53061</a> [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink <code>organizations</code></li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/53618\">#53618</a> [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement <code>authentication</code></li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/53749\">#53749</a> CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout <code>oidc</code></li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/53813\">#53813</a> [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass <code>authentication</code></li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54333\">#54333</a> [CVE-2026-111497] Out-of-bounds write in bundled Brotli decoder <code>dist/quarkus</code></li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54687\">#54687</a> [CVE-2026-112201] Login-failure upsert trusts MySQL/MariaDB affected-row count </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54688\">#54688</a> [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login (reproduced on 26.8.1) </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54689\">#54689</a> [CVE-2026-110932] Keycloak &lt;= 26.8.0 : Unauthenticated persistent disk exhaustion (theme gzip cache) </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54690\">#54690</a> [CVE-2026-107123] Unauthenticated DoS in Keycloak SAML endpoint </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54691\">#54691</a> [CVE-2026-107124] Session takeover by victim logout with injected id_token_hint  </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54692\">#54692</a> [CVE-2026-107602] Unauthenticated CPU and worker-pool exhaustion (restart required) via SAML 1.1 KeyInfo parser loop on a legal ds:KeyName </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54693\">#54693</a> [CVE-2026-110931] Unauthenticated single-request JVM termination (OutOfMemoryError) via SAML 1.1 AuthorityBinding parser loop, incomplete fix of CVE-2026-7307 </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54694\">#54694</a> [CVE-2026-97367] DCR azp+sid claim substitution via User Property mappers allows Account REST victim session takeover — #YWH-PGM40475-313 </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54695\">#54695</a> [CVE-2026-97174] CIBA sub parameter injection causes attacker authentication to issue victim tokens — #YWH-PGM40475-289 </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54696\">#54696</a> [CVE-2026-114232] UMA user-managed permission resourceType field not validated — cross-owner resource access — #YWH-PGM40475-306 </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54697\">#54697</a> [CVE-2026-97847] Client manager can replace a sessionless token principal and take over the realm — #YWH-PGM40475-292 </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54698\">#54698</a> [CVE-2026-96547] DCR registration-time claim-path gap: attribute mappers forge realm_access.roles from user-editable fields </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54699\">#54699</a> [CVE-2026-96457] Group-admin DENY bypass via top-level move (GroupsResource, CVE-2026-9099 regression) </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54700\">#54700</a> [CVE-2026-96460] Token from token exchange can have unlimited expiration </li>\n<li><a href=\"https://github.com/keycloak/keycloak/issues/54701\">#54701</a> [CVE-2026-97848] [SE"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}