README

!Keycloak

!GitHub Release




!GitHub Repo stars
!GitHub commit activity


 Open Source Identity and Access Management

Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.

Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more.


 Help and Documentation

 Documentation
 User Mailing List - Mailing list for help and general questions about Keycloak
 Join keycloak for general questions, or keycloak-dev on Slack for design and development discussions, by creating an account at https://slack.cncf.io/.


 Reporting Security Vulnerabilities

If you have found a security vulnerability, please look at the instructions on how to properly report it.


 Reporting an issue

If you believe you have discovered a defect in Keycloak, please open an issue.
Please remember to provide a good summary, description as well as steps to reproduce the issue.


 Getting started

To run Keycloak, download the distribution from our website. Unzip and run:

    bin/kc.[sh|bat] start-dev

Alternatively, you can use the Docker image by running:

    docker run quay.io/keycloak/keycloak start-dev
    
For more details refer to the Keycloak Documentation.


 Building from Source

To build from source, refer to the building and working with the code base guide.


 Testing

To run tests, refer to the running tests guide.


 Writing Tests

To write tests, refer to the writing tests guide.


 Contributing

Before contributing to Keycloak, please read our contributing guidelines. Participation in the Keycloak project is governed by the CNCF Code of Conduct.

Joining a community meeting is a great way to get involved and help shape the future of Keycloak.

 Code of Conduct

We are committed to providing a safe, welcoming, and constructive environment for all Keycloak contributors and users.
To protect this space, we actively enforce our Code of Conduct.
If you wish to report an incident or appeal a moderation decision, please email [email protected].

 Other Keycloak Projects

 Keycloak - Keycloak Server and Java adapters
 Keycloak Client - Keycloak client libraries
 Keycloak QuickStarts - QuickStarts for getting started with Keycloak
 Keycloak Node.js Connect - Node.js adapter for Keycloak


 License

 Apache License, Version 2.0

Top issues

Discussions

Latest release

Upgrading
Before upgrading refer to the migration guide for a complete list of changes.

All resolved issues

Security fixes

53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
54333 [CVE-2026-111497