keycloak · Issues· 3263 open
Open on GitHubLocally synced open issues (discussions stay on GitHub)
- #52225
migration to 26.7.x with all realms in single transaction
kind/enhancementstatus/triageUpdated Sep 17, 2026 - #49558
TiDB: Support Graceful Shutdown behavior of TiDB Pods
kind/enhancementstatus/triageUpdated Sep 17, 2026 - #20843
Ability to Specify OIDC Client ID in Keycloak Admin Web UI Reset Credentials Form
kind/enhancementstatus/triageUpdated Sep 17, 2026 - #52910
508 Compliance Scans - High and Critical Issues Found
kind/bugarea/authentication/webauthnstatus/auto-expirestatus/missing-informationteam/core-authnUpdated Sep 17, 2026 - #49833
Client authentication with SPIFFE X509 SVID
area/oidckind/enhancementstatus/triageteam/core-protocolsUpdated Sep 17, 2026 - #50642
Stateless mode: make it a supported feature
kind/enhancementpriority/importantteam/production-readinessUpdated Sep 17, 2026 - #44834
[OID4VCI] Limit the audience of the access token to credential issuance
kind/enhancementstatus/triagearea/oid4vcteam/core-clientsUpdated Sep 17, 2026 - #50522
[OID4VCI] tx_code (transaction PIN) second factor is non-functional — field never assigned
area/oid4vcpriority/normalteam/core-protocolskind/weaknessUpdated Sep 17, 2026 - #44745
[OID4VCI] Impersonation possible in OID4VCI credential creation endpoint
status/needs-discussionarea/oid4vcteam/core-clientspriority/normalkind/weaknessUpdated Sep 17, 2026 - #44960
[OID4VCI] Do not bind preauthorized code to single OIDC client
kind/enhancementstatus/triageUpdated Sep 17, 2026 - #51278
[CVE-2026-18206] Client policy source-host wildcard domains match non-subdomain suffixes
area/oidcpriority/importantkind/cvebackport/26.6team/core-protocolsbackport/26.7Updated Sep 17, 2026 - #50244
Creating a custom 'EventStoreProvider' implementation with order() < 0 results in a NPE
kind/bugarea/corehelp wantedteam/core-sharedpriority/lowstatus/auto-bumpteam/core-protocolsUpdated Sep 17, 2026 - #51285
[CVE-2026-18211] Secure-client-uris localhost exception accepts localhost-prefixed attacker domains
area/oidcpriority/importantkind/cvebackport/26.6team/core-protocolsbackport/26.7Updated Sep 17, 2026 - #52903
Fix react-compiler warnings: mutations, debounce, and delete patterns in admin UI
Updated Sep 17, 2026 - #40403
Produce 'Logout' event in event listener provider when 'SSO Session Max' is reached
area/authenticationkind/enhancementhelp wantedteam/core-clientsUpdated Sep 17, 2026