IDPTrust
IDPTrust Blog
blog.idptrust.com
Keycloak 26.7.0: SCIM, AuthZEN, identity brokering v2 (and 4 CVEs to review)

Keycloak 26.7.0: SCIM, AuthZEN, identity brokering v2 (and 4 CVEs to review)

· News · IDPTrust

Keycloak 26.7.0 was released on July 9, 2026. Unlike the previous release (26.6.4), this is a feature release: new administration and identity brokering APIs, SCIM promoted to preview, an AuthZEN implementation, real-time security signals, and SAML step-up finally graduating to supported. It also ships 4 CVE fixes, so the upgrade carries a security dimension worth planning for.

Here is what changed and why it matters for teams running Keycloak in production.

The highlights

Identity Brokering API v2

Brokering: Keycloak as the intermediary between your apps and external identity providers (Google, a corporate SAML/OIDC IdP).

When a user logs in through an external provider, Keycloak stores that provider's tokens. The identity brokering API lets your applications retrieve those tokens to call the external provider on the user's behalf (for example, to read their profile or reach its APIs). V2 hardens the security of that access with client-level authorization (you control which client can obtain the brokered tokens), confidential-client-only support, OAuth 2.0 compliance, and session-based token storage. V1 remains enabled by default but is now deprecated. Plan your migration to v2.

Admin API v2

New REST API for OIDC/SAML client management, with strict validation and accurate OpenAPI.

Keycloak introduces a new Admin API v2 for OIDC and SAML client management, with strict validation, declarative configuration, and accurate OpenAPI specifications. It's available through the Java client, the JavaScript client, and the CLI. It's the foundation for automating client administration.

SCIM for user provisioning (preview)

Keycloak as a SCIM server: an external system provisions users and groups into Keycloak.

The SCIM API moves to preview (it's the SCIM Realm API we covered as an experimental feature back in 26.6). Keycloak acts as a SCIM server, not a client: it exposes its user and group management through the SCIM protocol so an upstream system (for example Microsoft Entra ID or an HR system) can create and remove accounts automatically, instead of doing it by hand realm by realm. It supports full CRUD, PATCH operations, filtering, pagination, and schema extensions.

AuthZEN Authorization API

Fine-grained authorization over a vendor-neutral protocol.

Keycloak implements the vendor-neutral AuthZEN protocol, with single and batch evaluation endpoints for fine-grained authorization requests. It makes it easier to externalize authorization decisions without coupling to a proprietary implementation.

Real-time security signals (OpenID SSF, experimental)

Signed Security Event Tokens when a user logs out, changes credentials, or is disabled.

This experimental feature delivers signed Security Event Tokens to applications on events such as logout, credential change, or account disablement. It supports the CAEP 1.0 and RISC 1.0 profiles with push and poll delivery.

Step-up authentication (now supported, including SAML)

Step-up: ask for stronger authentication only when it's needed.

Step-up authentication lets a user sign in with a basic level (for example, username and password) and then, when they attempt a sensitive operation (a transfer, changing critical data, entering a protected area), Keycloak requires an additional factor (OTP, passkey) at that moment to raise the assurance level. It avoids forcing a second factor on every login and reserves it for what actually needs it. In 26.7.0 it graduates from preview to supported and extends to the SAML protocol (previously OIDC only).

Other changes worth noting

  • Organization admin roles. New manage-organizations, view-organizations, and query-organizations roles, plus Fine-Grained Admin Permissions (FGAP) per organization.
  • Organization group role inheritance. Groups support realm and client role assignments that automatically appear in token claims.
  • Discoverable credential option in WebAuthn. New required, preferred, and discouraged values for improved passkey compatibility.
  • Multi-Cluster v2 (preview). Removes the external Infinispan requirement (instances connect directly via embedded Infinispan caches with database-backed cache invalidation).
  • Operator kustomize installation. A declarative, reproducible method for vanilla Kubernetes clusters, plus the AllNamespaces mode (preview) for a single Operator instance across the cluster.
  • SCIM, AuthZEN, cross-domain token exchange, and token exchange delegation widen the catalog of supported standards. Several of these remain experimental.

Security: 4 CVEs fixed

This release isn't only features: it patches four CVEs worth reviewing.

  • CVE-2026-9796. Admin role rename TOCTOU vulnerability enabling realm-wide escalation.
  • CVE-2026-11986. Fine-Grained Admin Permissions (FGAP) v1 allowing unauthorized role unassignment.
  • CVE-2026-9798. CIBA authentication flow bypassing brute-force account lockout.
  • CVE-2026-9689. HTTP Parameter Pollution in the OIDC redirect URI, causing response parameter duplication.

Several robustness weaknesses are also addressed: SAML Identity Provider signature defaults, WebAuthn challenge consumption, OTP constant-time comparison, SSF authorization checks, and various FIPS- and cache-related improvements.

Deprecations and migration changes

  • Identity Brokering API v1 deprecated (migrate to v2).
  • Twitter IDP deprecated (relies on the outdated twitter4j library).
  • Token Exchange External-Internal v2 (support removed).
  • Batching option for persistent sessions (removed).
  • WebAuthn "Require Discoverable Credential" (planned for removal).

Before upgrading, review the official migration guide: there are database schema updates for the new features, FGAP v1 behavior changes regarding role unassignment, and the Identity Brokering v1 API is set to be disabled by default in future versions.

Should you upgrade?

Yes, with planning. The bulk of the release is features, but the 4 CVEs make it wise not to defer the upgrade, especially the TOCTOU escalation (CVE-2026-9796) and the FGAP v1 role unassignment (CVE-2026-11986). Plan it within your normal maintenance window, and if you use identity brokering, take the opportunity to prepare the migration to the v2 API.

Full release notes: keycloak.org/2026/07/keycloak-2670-released

At IDPTrust we specialize in Keycloak in production. If you need help assessing this release or planning an upgrade, get in touch.