A fully managed Keycloak solution with 99.95% SLA, ISO 27001 certification, 24/7 expert support — all hosted in Europe to ensure compliance and data sovereignty
Internet
Joined July 2019
- Tweets252
- Following28
- Followers217
- Likes62
We ship a lot and we didn’t talk about it much. So we shipped a changelog: features, fixes, security releases.
See it all here: eu1.hubs.ly/H0zhgHC0
We’re still figuring out what deserves a spot on it, so tell us what you’d want to see.
We're happy to announce that we are sponsor of the A la french conference on December 3rd in Paris!
The conference will be full of surprises and we're bringing some of ours too🛡️🛡️🛡️
Don't miss out and come see us there!
Keycloak 26.8.1 is out! It fixes 7 HIGH or CRITICAL CVEs that all come from Keycloak dependencies.
Details in the replies ⏬
The full list of fixes is on the official announcement: keycloak.org/2026/10/keycloa…, and the version will be available shortly on Cloud-IAM.
CVE-2025-66021 - 8.6 (OWASP Java HTML Sanitizer)
The sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This does not happen in Keycloak's own sanitizer policies but could happen in custom extensions.
You can find more information in the official migration guide: lnkd.in/eh6FMpBz and details about the other CVEs in the release post: lnkd.in/eTk-xaie.
CVE-2026-90997: When using MySQL or MariaDB as the database in stateless mode, the replay protection mechanism for single-use security artifacts fails to detect reuse due to a row-count semantics mismatch between the database driver's default configuration and 🧵