keycloak/keycloak
Open Source Identity and Access Management For Modern Applications and Services
How keycloak is put together
This repository is the Keycloak identity and access management (SSO/IdP) server, organized as a large multi-module Maven project targeting Java 17, with its primary runtime built on Quarkus. Core server logic lives in modules such as services, model (JPA and Infinispan persistence), crypto, saml-core, authz, federation, ssf, and authzen, while the modern admin and account frontends are React/TypeScript applications under js/ built with Vite and packaged as themes into the server distribution. Data flows from HTTP endpoints through RESTEasy/Jakarta services into JPA-backed relational stores or Infinispan caches, with adapters (SAML/WildFly) allowing external applications to delegate authentication to the server. A dedicated test-framework and testsuite hierarchy provisions real database containers (Postgres, MySQL, MariaDB, MSSQL, Oracle, TiDB, H2) and remote servers, and an Ansible role (aws_ec2) manages EC2 instances for running Keycloak tests.
Languages
Frameworks
Datastores
Infrastructure
Major components
quarkus (runtime/deployment/server/config-api/container)
Builds and packages the Quarkus-based Keycloak server distribution, including its config API and container image.
model (jpa, infinispan, storage)
Persistence layer providing JPA entities/migrations and Infinispan-backed clustered storage models.
services
Core server-side implementations of authentication, protocol endpoints, and realm/user management.
adapters (saml core, spi, wildfly/wildfly-elytron)
Client-side SAML adapter libraries that let applications integrate with Keycloak, including WildFly/Elytron integration.
authz (policy, client)
Fine-grained authorization policy engine and client library for Keycloak Authorization Services.
federation (ldap, kerberos, sssd, ipatuura)
User federation providers syncing identities from LDAP, Kerberos, SSSD, and related backends.
js apps & libs (admin-ui, account-ui, themes-vendor, keycloak-admin-client)
React/TypeScript admin and account consoles plus shared frontend libraries, bundled as server themes.
test-framework & testsuite
Reusable builders, per-database modules, OAuth/email/infinispan test harnesses, and integration test suites (including Arquillian legacy suite).
A focused week of security fixes around tokens and signatures, plus new delegation and digital credential features.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A focused week of security fixes around tokens and signatures, plus new delegation and digital credential features.
Week of 2026-08-17
A large week dominated by closing policy-bypass holes, enforcing stricter signature checks, and marking client secret rotation as fully supported.
Week of 2026-08-10
Heavy focus on fixing information leaks in the admin API under fine-grained permissions, plus many SCIM performance and correctness improvements.
Week of 2026-08-03
A security-heavy week that patched a denial-of-service CVE and several authorization bypasses, while tightening SCIM permissions across the board.
Week of 2026-07-27
Verifiable credential work accelerated with multiple OID4VCI vulnerability fixes, alongside a leaked-secrets CVE patch and new account-status SSF events.
Over the past five weeks the Keycloak team shipped a steady stream of security hardening fixes—closing bypasses in client policies, SAML signature checks, token exchange permissions, and admin API data leaks—while pushing forward major feature areas like verifiable credentials (OID4VCI/OID4VP), token exchange delegation, SCIM support, and a new workflow engine. Infrastructure work continued in parallel with Quarkus and Infinispan upgrades, database performance tuning, and migration of old tests to a modern framework. The overall arc shows a project maturing new identity features while aggressively patching vulnerabilities found through internal review.
Week by week
2026-08-24A focused week of security fixes around tokens and signatures, plus new delegation and digital credential features.latest6 changes
Fix
Refresh token replay vulnerability fixed
Closed a loophole where a refresh token could be reused within the same second to get extra sessions.
Fix
Safer post-logout redirect checking
Improved validation of where users are sent after logging out so attackers can't redirect them elsewhere.
Feature
Token Exchange Delegation for clients
Clients can now securely act on behalf of users when exchanging tokens, with clearer permission scoping.
Fix
SAML signature compatibility fix
Removed an unnecessary default namespace in SAML message writing so signatures validate correctly with more partners.
Feature
Digital credential attribute mappers
New mappers let user attributes and session data flow into SD-JWT-based verifiable credentials (OID4VP).
Feature
Organization invite improvements
The invite-user endpoint now accepts a client_id parameter for more targeted invitations.
2026-08-17A large week dominated by closing policy-bypass holes, enforcing stricter signature checks, and marking client secret rotation as fully supported.6 changes
Fix
Admin role resolution boundary fixed
Fixed a case where a client scope boundary could be sidestepped when resolving admin roles.
Fix
SAML logout signature enforcement
Servers now verify signatures on SAML logout responses for clients that require signed messages.
Feature
Client secret rotation goes supported
The client secret rotation capability graduated from preview to fully supported, including admin API integration.
Chore
Quarkus upgrade
Upgraded the underlying Quarkus framework to version 3.39.0.CR1 and fixed inherited CVEs from ApacheDS/Kerby.
Refactor
Faster offline session storage
Optimized index sizes and added session buckets to reduce database contention at scale.
Fix
Certificate name truncation per standard
Certificate common names are now truncated to 64 characters as required by the X.509 (RFC 5280) standard.
2026-08-10Heavy focus on fixing information leaks in the admin API under fine-grained permissions, plus many SCIM performance and correctness improvements.6 changes
Fix
Hidden roles no longer leaked via admin API
Role-mapping endpoints and composite role lookups no longer reveal client role details that restricted admins shouldn't see.
Refactor
SCIM search speedups
Removed unnecessary database count queries and redundant object allocations, making SCIM user listings much faster.
Fix
SCIM federated user leak fixed
Unfiltered SCIM searches no longer return federated users that were never imported locally.
Feature
Encrypted TLS certificate keys
Servers can now use password-protected PEM files for their HTTPS certificates.
Fix
WebAuthn error messages improved
Clearer messages help users understand what went wrong during security-key login.
Docs
OID4VCI wallet integration guide
Added documentation explaining how to integrate Keycloak's verifiable credentials with the Lissi wallet.
2026-08-03A security-heavy week that patched a denial-of-service CVE and several authorization bypasses, while tightening SCIM permissions across the board.6 changes
Fix
CVE-2026-16100 fixed
Blocked a memory-exhaustion attack where specially crafted error text could balloon server metrics.
Fix
Path-based authorization bypass closed
Normalized URL path handling so attackers can't sneak past access rules using mutated paths.
Fix
SCIM write permissions enforced
User changes through SCIM can no longer bypass user-profile edit permissions or attribute mutability rules.
Fix
SAML IdP-initiated login restricted
Broker logins started by the identity provider are now limited to link-only mode for safety.
Feature
Impersonation audit trail enriched
Impersonation events now record who did the impersonating plus extra details for better auditing.
Refactor
Workflow scheduling index added
A new composite database index makes finding due workflow steps much quicker.
2026-07-27Verifiable credential work accelerated with multiple OID4VCI vulnerability fixes, alongside a leaked-secrets CVE patch and new account-status SSF events.6 changes
Fix
CVE-2026-17048 fixed
The admin REST API no longer leaks actual rotated client secret values resolved from the vault.
Fix
Credential decryption downgrade fixed
Blocked an attack where weaker encryption algorithms could be forced on credential requests (OID4VCI).
Fix
Key attestation validation hardened
Strengthened certificate validation for hardware key attestations and made them configurable in the admin console.
Feature
Account status events emitted
Disabling or enabling an account now triggers standardized RISC security event notifications.
Fix
Email verification works after restart
Users can now complete email verification in incognito tabs even after the server restarts.
Chore
Framework upgrades
Upgraded to Quarkus 3.37.4 and Infinispan 16.0.14, and added Korean translations for all themes.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required