Keycloak 26.7.5 released

To download the release go to Keycloak downloads . Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50996 [CVE-2026-16103] Incomplete fix for CVE-2026-9798 (Keycloak CIBA brute-force lockout bypass at token redemption) oidc #51278 [CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes oidc #51280 [CVE-2026-18203] Group policy child-extension matches sibling group path prefixes authorization-services #51281 [CVE-2026-18207] Source-group condition matches duplicate group names and can ski