Skip to main content

Phase Two: October 2026

Phase Two shipped thirty-eight extension releases this month across seven repositories, with Organizations, magic links, themes, events and webhooks and atomic auth flows all rebuilt on Keycloak 26.8.0. The notable fixes: an account enumeration hole in magic links, and N+1 queries gone from organization listings.

Upstream closed forty CVEs across 26.7.5, 26.8.0 and 26.8.1. Read 26.8.1 first and upgrade this week if you broker SAML or use mTLS. On 26.6 or 26.4, read 26.7.5 too: it fixes a critical CVE in a bundled library, and neither branch has a patched tag yet.

Official Keycloak​

  • 🔐 Keycloak 26.8.1: 19 CVEs, none above medium in Keycloak itself, plus an unrated SAML broker bypass — upgrade this week if you broker SAML or use mTLS. (our write-up)
  • 🔐 Keycloak 26.8.0: SCIM, multi-cluster v2 and client secret rotation promoted to supported, token exchange delegation added, seven CVEs fixed. (our write-up)
  • 🔐 Keycloak 26.7.5: 14 CVEs, one critical in a bundled library — upgrade this week on 26.7, and note that 26.6 and 26.4 have no patched tag yet. (our write-up)

Phase Two open source releases​

  • 🏛️ Organizations v0.192: on 26.8.0, with the N+1 queries gone from organization listing and membership lookups, and an index on ORGANIZATION_DOMAIN. (docs)
  • 🔗 Magic links v0.94: closes an account enumeration hole in the continuation flow, stops invalid email input creating a user, and fixes the Turnstile config check. (docs)
  • 🎨 Themes v0.89: the email preview renders the realm's own brand tokens, so what you see is what sends, plus a neutral phasetwo-ui welcome theme. (docs)
  • 🪝 Events and webhooks v0.66: the ext-event-email listener is registered properly, and includedEvents parsing no longer falls over on unexpected input. (docs)
  • 🧩 Admin portal v0.63: the sign-in profile handles passwordless WebAuthn credentials correctly, and shows the password row when the user has one. (docs)
  • ⚛️ Atomic auth flows v0.4: rebuilt on 26.8.0, no functional change since v0.2. (read more)
  • 🧙 IdP wizard v0.57: a build pipeline sync, no functional change. (docs)

New reading​

  • 📖 Keycloak Meetup #1, London, 20 November: the Keycloak User Group UK's first meetup, 1–5pm at London Bridge Hive. We are sponsoring. (details)
  • 📖 Where your Keycloak data lives: what sits in Frankfurt, what is backed up to Ireland, what runs in the US, and who you contract with — plus what residency does not buy you, and the checklist a DPO sends. (where it lives · residency vs sovereignty · the DPO checklist)
  • 📖 Moving onto Keycloak: tested walkthroughs for Auth0 and Okta, what Azure AD B2C's end of sale really means, when to migrate users lazily rather than in bulk, and how a store drops homegrown login. (Auth0 · Okta · Azure AD B2C · slow vs fast · e-commerce)
  • 📖 Three login failures, decoded: a 502 is always the proxy, a redirect loop is almost always a dropped cookie, and "Restart login cookie not found" never means the cookie expired. (502 · redirect loop · restart cookie)
  • 📖 Two decisions about your login page: which default clients to leave enabled once scanners start probing, and what the passkey timing studies measured. (go-live clients · passkeys)
  • 📖 Fifteen new tutorials: protocol mappers, the aud claim, client types, multi-tenancy, SPIs, SCIM filtering and MCP server auth. (browse them)

Running Keycloak yourself and want the upgrades handled? Phase Two hosts it. Already self-hosting and want a number to call? We support it.

Last updated on