Bottom line: upgrade this week if you are on 26.7. If you are on 26.6 or 26.4, the fixes are merged to your branch but nobody has tagged a release, so there is no build to take. Keycloak 26.7.5 fixes 14 CVEs: ten in Keycloak, none rated above medium (6.5), and four in bundled libraries, one of them critical. Three breaking changes, one of which changes what lands in your tokens.
Keycloak publishes releases and container images for the current minor version only. It does backport selected security fixes to the two most recent even-numbered branches, and it tags them — but it cuts no GitHub release and builds no image from those tags. As of today there are nine such tags on release/26.4 and three on release/26.6, containing fixes for CVEs that were announced months ago, that you cannot docker pull from anywhere upstream.
Phase Two now builds them. quay.io/phasetwo/keycloak:26.4.16 and quay.io/phasetwo/keycloak:26.6.7 exist today, built from the tag's own Dockerfile, and we intend to keep building the two previous minor lines alongside the current one for as long as upstream keeps backporting to them.
Bottom line: upgrade this week if your login page or SAML endpoints are reachable from the internet, or if you run stateless mode on MySQL/MariaDB. Otherwise take it in your normal cycle. Keycloak 26.7.4 fixes six CVEs — five published as high, one medium. Two of them let an unauthenticated attacker exhaust memory and crash the server by hitting endpoints that are open by definition. One breaking change, in Authorization Services URI matching.
You clicked "Log in", Keycloak showed you "We are sorry… Invalid parameter: redirect_uri", and no amount of staring at the admin console explains why.
The short answer: the redirect_uri your application sent does not match, character for character after wildcard expansion, any entry in that client's Valid redirect URIs. The long answer is that Keycloak's matching rules are stricter and stranger than almost everyone assumes — in particular, it will reject any redirect_uri containing a query string, no matter what you registered.
Everything below was tested against Keycloak 26.7.3.
Bottom line: not an emergency, but upgrade this week if you use token exchange with a Google or Microsoft broker, or FGAP v2 to delegate admin rights. On 26.4, 26.5 or 26.6 there is no patch for you today. Keycloak 26.7.3 fixes 20 CVEs — one high, 17 medium, one low, one unrated — plus two breaking changes. Every one needs a delegated admin account, client credentials, or an intercepted authorization code; the single high is in a test-only dependency.
Phase Two is excited to announce that we are now ISO/IEC 27001 certified.
This milestone reflects how seriously we take security and compliance across our platform, operations, and internal processes. We completed this as a fast follow to our September 17, 2025 SOC 2 Type II compliance milestone, reaching full ISO/IEC 27001 certification just over six months later as part of our commitment to building a mature, enterprise-ready security program.
Learn more at our Trust Center: trust.phasetwo.io.
At Phase Two, we are committed to providing our customers with the most secure and reliable managed Keycloak hosting platform. As part of this commitment, we are excited to announce the release of new security capabilities for Keycloak clusters available through the Phase Two Dash.
Phase Two is excited to share that we have successfully completed a SOC 2 Type II audit. This independently validates that our security and availability controls were not just designed well, but operated effectively over time.
Learn more and request report access at our Trust Center: trust.phasetwo.io.
We are excited to announce that Phase Two has achieved SOC 2 Type 1 compliance! This milestone demonstrates our ongoing commitment to security, availability, and the protection of our customers’ data.
Learn more at trust.phasetwo.io.
As more companies adopt Keycloak for enterprise identity and access management, security is no longer just a back-end concern. One of the most frequent questions we hear at Phase Two is:
"Should I put a Web Application Firewall (WAF) in front of Keycloak?"
The short answer? It depends—but it's a smart question to ask.
In this post, we'll break down what Keycloak provides out of the box, explore common attack vectors (especially around authentication endpoints), and help you evaluate whether you need to add an external firewall or WAF to your deployment.