Skip to content

Bump keycloak.version from 25.0.2 to 26.6.4 in /bulkfetchuserscustomendpoint - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/bulkfetchuserscustomendpoint/keycloak.version-26.6.4
Open

Bump keycloak.version from 25.0.2 to 26.6.4 in /bulkfetchuserscustomendpoint#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/bulkfetchuserscustomendpoint/keycloak.version-26.6.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 2, 2026

Copy link
Copy Markdown

Bumps keycloak.version from 25.0.2 to 26.6.4.
Updates org.keycloak:keycloak-core from 25.0.2 to 26.6.4

Release notes

Sourced from org.keycloak:keycloak-core's releases.

26.6.4

26.6.3

... (truncated)

Commits
  • dc1bfc5 Set version to 26.6.4
  • 39d40b1 fix(keycloak-admin-client): fix JS failures due to Kiota bug (#49643)
  • d459fc3 Upgrade to Quarkus 3.33.2.1 (#776)
  • 6d61885 CVE-2026-11800 Remove support for symmetric algorithms in JWT public key vali...
  • 32cdceb Consider case-sensitivity when validating prohibited schemes of client URIs (...
  • 1bc0dd3 Restrict java keystore files to a realm folder (#703)
  • be81d60 CVE-2026-9705 check if client is enabled when RAT is used
  • 11b83fc GroupResource.addChild missing requireManage(child) (#707)
  • e5507d9 [26.6] Missing requireMapClientScope in ScopeMappedResource and ScopeMappedCl...
  • bdb4db3 Skip owner managed resources when enforcement mode is set to permissive (#692)
  • Additional commits viewable in compare view

Updates org.keycloak:keycloak-server-spi from 25.0.2 to 26.6.4

Release notes

Sourced from org.keycloak:keycloak-server-spi's releases.

26.6.4

26.6.3

... (truncated)

Commits
  • dc1bfc5 Set version to 26.6.4
  • 39d40b1 fix(keycloak-admin-client): fix JS failures due to Kiota bug (#49643)
  • d459fc3 Upgrade to Quarkus 3.33.2.1 (#776)
  • 6d61885 CVE-2026-11800 Remove support for symmetric algorithms in JWT public key vali...
  • 32cdceb Consider case-sensitivity when validating prohibited schemes of client URIs (...
  • 1bc0dd3 Restrict java keystore files to a realm folder (#703)
  • be81d60 CVE-2026-9705 check if client is enabled when RAT is used
  • 11b83fc GroupResource.addChild missing requireManage(child) (#707)
  • e5507d9 [26.6] Missing requireMapClientScope in ScopeMappedResource and ScopeMappedCl...
  • bdb4db3 Skip owner managed resources when enforcement mode is set to permissive (#692)
  • Additional commits viewable in compare view

Updates org.keycloak:keycloak-server-spi-private from 25.0.2 to 26.6.4

Release notes

Sourced from org.keycloak:keycloak-server-spi-private's releases.

26.6.4

26.6.3

... (truncated)

Commits
  • dc1bfc5 Set version to 26.6.4
  • 39d40b1 fix(keycloak-admin-client): fix JS failures due to Kiota bug (#49643)
  • d459fc3 Upgrade to Quarkus 3.33.2.1 (#776)
  • 6d61885 CVE-2026-11800 Remove support for symmetric algorithms in JWT public key vali...
  • 32cdceb Consider case-sensitivity when validating prohibited schemes of client URIs (...
  • 1bc0dd3 Restrict java keystore files to a realm folder (#703)
  • be81d60 CVE-2026-9705 check if client is enabled when RAT is used
  • 11b83fc GroupResource.addChild missing requireManage(child) (#707)
  • e5507d9 [26.6] Missing requireMapClientScope in ScopeMappedResource and ScopeMappedCl...
  • bdb4db3 Skip owner managed resources when enforcement mode is set to permissive (#692)
  • Additional commits viewable in compare view

Updates org.keycloak:keycloak-services from 25.0.2 to 26.6.4

Release notes

Sourced from org.keycloak:keycloak-services's releases.

26.6.4

26.6.3

... (truncated)

Commits
  • dc1bfc5 Set version to 26.6.4
  • 39d40b1 fix(keycloak-admin-client): fix JS failures due to Kiota bug (#49643)
  • d459fc3 Upgrade to Quarkus 3.33.2.1 (#776)
  • 6d61885 CVE-2026-11800 Remove support for symmetric algorithms in JWT public key vali...
  • 32cdceb Consider case-sensitivity when validating prohibited schemes of client URIs (...
  • 1bc0dd3 Restrict java keystore files to a realm folder (#703)
  • be81d60 CVE-2026-9705 check if client is enabled when RAT is used
  • 11b83fc GroupResource.addChild missing requireManage(child) (#707)
  • e5507d9 [26.6] Missing requireMapClientScope in ScopeMappedResource and ScopeMappedCl...
  • bdb4db3 Skip owner managed resources when enforcement mode is set to permissive (#692)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps `keycloak.version` from 25.0.2 to 26.6.4.

Updates `org.keycloak:keycloak-core` from 25.0.2 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](keycloak/keycloak@25.0.2...26.6.4)

Updates `org.keycloak:keycloak-server-spi` from 25.0.2 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](keycloak/keycloak@25.0.2...26.6.4)

Updates `org.keycloak:keycloak-server-spi-private` from 25.0.2 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](keycloak/keycloak@25.0.2...26.6.4)

Updates `org.keycloak:keycloak-services` from 25.0.2 to 26.6.4
- [Release notes](https://github.com/keycloak/keycloak/releases)
- [Commits](keycloak/keycloak@25.0.2...26.6.4)

---
updated-dependencies:
- dependency-name: org.keycloak:keycloak-core
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-server-spi
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-server-spi-private
  dependency-version: 26.6.4
  dependency-type: direct:production
- dependency-name: org.keycloak:keycloak-services
  dependency-version: 26.6.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@mikroozgurmaden

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Detailse90bdfd2-d46a-4da1-8330-1f27f1831b22


New Issues (9) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 HIGH CVE-2026-9086 Maven-org.keycloak:keycloak-services-26.6.4
detailsDescription: A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to cli...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 HIGH CVE-2026-9086 Maven-org.keycloak:keycloak-services-25.0.2
detailsDescription: A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to cli...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 MEDIUM CVE-2026-2575 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compr...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 MEDIUM CVE-2026-37977 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's Use...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 MEDIUM CVE-2026-37979 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confident...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 MEDIUM CVE-2026-7500 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 MEDIUM CVE-2026-8830 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-s...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 MEDIUM CVE-2026-8922 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OID...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
9 LOW CVE-2026-4874 Maven-org.keycloak:keycloak-services-25.0.2
detailsRecommended version: 26.0.5.redhat-00003
Description: A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` pa...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

Fixed Issues (8) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
HIGH CVE-2025-66021 Maven-com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer-20240325.1
HIGH CVE-2026-54512 Maven-com.fasterxml.jackson.core:jackson-databind-2.17.0
HIGH CVE-2026-54513 Maven-com.fasterxml.jackson.core:jackson-databind-2.17.0
HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.17.0
MEDIUM CVE-2025-7962 Maven-org.eclipse.angus:angus-mail-2.0.1
MEDIUM CVE-2026-54514 Maven-com.fasterxml.jackson.core:jackson-databind-2.17.0
MEDIUM CVE-2026-54515 Maven-com.fasterxml.jackson.core:jackson-databind-2.17.0
LOW Cxeb68d52e-5509 Maven-commons-codec:commons-codec-1.11

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant