Keycloak 26.6.3 is a critical security-focused maintenance release. It patches a large volume of vulnerabilities (including SSRF and bypass mechanisms) while resolving a high-impact bug that caused server exits during asynchronous migrations. It also introduces health checks for database indexes and improves consistency across LDAP and SQL Server environments.

Critical Security Update Addressing Multiple CVEs — This release addresses 16 CVEs covering critical areas like OIDC token manipulation, SSRF, and improper access control. Upgrading is essential to protect your IAM infrastructure from unauthorized access and data exposure.

Reliability Fix for Server Startup and Migrations — Resolves a critical regression where the Keycloak server would exit prematurely during migrations, potentially leaving the database in an inconsistent state.

Automated Startup Check for Missing Database Indexes — Ensures your database is optimized for Keycloak's query patterns, preventing performance degradation as your user base grows.

LDAP and SQL Server Integration Stability Fixes — Fixes issues where LDAP users were forced to reset passwords even after update tasks were completed, and addresses SQL Server case-sensitivity issues during upgrades.

Authorization and Resource Sharing Logic Corrections — Corrects logic where UMA and Account API sharing could accidentally grant access to the wrong user or expose data in realms where specific features were disabled.