Package
request-9047-keycloak-fips-26.5-iamguarded-fips
Component
keycloak-services
Latest update
Fixed version
26.5.7-r26
9.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
26.5.7-r26Impact
Fixed by cherry-picking the upstream release/26.4 backport (commit 51ad69773eff) onto the 26.5.7 tag. The 26.5 release branch is archived upstream with no patched release; the fix is available only in 26.6.6, 26.4.15 and 26.7.2. Verified against the published artifact: ResetCredentialEmail.action() now validates the action-token user ID and fails with INVALID_USER, and DefaultAuthenticationFlow no longer trusts a boolean authentication-selector note. The Maven coordinate version is unchanged, so scanners may continue to match the declared version string.
Status