Commits

Commit history

1. Commits on Nov 11, 2026

   • Compare the normalized e-mail in isCaseOnlyChange

     Show description for cf5706f
     

     akasakariko

     authored and

     pedroigor

     committed
     cf5706fView commit details

     Copy full SHA for cf5706f

     View code at this pointBrowse repository at this point

   • Apply Trust Email when the IdP email differs only in case

     Show description for 1f2feb2
     

     akasakariko

     authored and

     pedroigor

     committed
     1f2feb2View commit details

     Copy full SHA for 1f2feb2

     View code at this pointBrowse repository at this point

   • Send the reset password email in the background.

     Show description for 46a401d
     

     gaoyikeshuer

     authored and

     rmartinc

     committed
     46a401dView commit details

     Copy full SHA for 46a401d

     View code at this pointBrowse repository at this point

   • Replace a credential only if unchanged when re-hashing a password

     Show description for e4bcd40
     

     ahus1

     and

     Copilot

     authored
     e4bcd40View commit details

     Copy full SHA for e4bcd40

     View code at this pointBrowse repository at this point

   • [CVE-2026-93998] Validate SAML issuer against configured IdP entity ID (#55011)

     Show description for 02d0c2f
     abstractj

     authored
     02d0c2fView commit details

     Copy full SHA for 02d0c2f

     View code at this pointBrowse repository at this point
2. Commits on Nov 10, 2026

   • Escape backslashes in jboss logging event message values.

     Show description for 1b78daf
     

     gaoyikeshuer

     authored and

     rmartinc

     committed
     1b78dafView commit details

     Copy full SHA for 1b78daf

     View code at this pointBrowse repository at this point

   • Fix SAML11 parsers infinite loops

     Show description for d732f58
     

     pskopek

     authored and

     mposolda

     committed
     d732f58View commit details

     Copy full SHA for d732f58

     View code at this pointBrowse repository at this point

   • Limit size of SOAP endpoint InputStream to prevent resources exhaustion. (#1247)

     Show description for 58ea6b6
     

     pskopek

     authored and

     mposolda

     committed
     58ea6b6View commit details

     Copy full SHA for 58ea6b6

     View code at this pointBrowse repository at this point

   • Reject SAML assertions with an unsupported ProxyRestriction condition (#54948)

     Show description for 13b38f4
     pedroigor

     authored
     13b38f4View commit details

     Copy full SHA for 13b38f4

     View code at this pointBrowse repository at this point

   • Make protocol mappers CRUD to be allowed to realm admins and not allow anything by DCR

     Show description for bec5218
     

     mposolda

     and

     Copilot

     committed
     bec5218View commit details

     Copy full SHA for bec5218

     View code at this pointBrowse repository at this point

   • Checking for admin roles in non-admin composite roles (#54949)

     Show description for 559c69c
     pedroigor

     authored
     559c69cView commit details

     Copy full SHA for 559c69c

     View code at this pointBrowse repository at this point

   • Limit the expiration of tokens issued by the standard token exchange to the subject token

     Show description for cbe2bc8
     

     graziang

     authored and

     mposolda

     committed
     cbe2bc8View commit details

     Copy full SHA for cbe2bc8

     View code at this pointBrowse repository at this point

   • Check the passed execution belongs to the flow being executed

     Show description for 8334a4a
     rmartinc

     authored
     8334a4aView commit details

     Copy full SHA for 8334a4a

     View code at this pointBrowse repository at this point

   • Stateless token preferred_username fallback enables identity rebinding after client recreation (#1265)

     Show description for bc9b1db
     mposolda

     committed
     bc9b1dbView commit details

     Copy full SHA for bc9b1db

     View code at this pointBrowse repository at this point

   • Make sure SSO_AUTH checks map the user authenticating (#54950)

     Show description for 6fc1beb
     pedroigor

     authored
     6fc1bebView commit details

     Copy full SHA for 6fc1beb

     View code at this pointBrowse repository at this point
3. Commits on Nov 9, 2026

   • Organization isolation bypass - nested organization groups can be re-parented under realm groups

     Show description for dc27efd
     

     vramik

     authored and

     pedroigor

     committed
     dc27efdView commit details

     Copy full SHA for dc27efd

     View code at this pointBrowse repository at this point

   • Verify the SAML redirect binding message that is processed

     Show description for 0685265
     

     ssilvert

     and

     pedroigor

     committed
     0685265View commit details

     Copy full SHA for 0685265

     View code at this pointBrowse repository at this point

   • Group-admin DENY bypass via top-level move

     Show description for 1a29685
     

     martin-kanis

     authored and

     pedroigor

     committed
     1a29685View commit details

     Copy full SHA for 1a29685

     View code at this pointBrowse repository at this point

   • Fix CIBAAuthReq with deserializing request checking for forged params added into otherClaims. Add DISABLED_REQ_PARAMS in BackchannelAuthenticationEndpointRequestParser.

     Show description for 5909f29
     

     lhanusov

     authored and

     mposolda

     committed
     5909f29View commit details

     Copy full SHA for 5909f29

     View code at this pointBrowse repository at this point

   • Enforce scope and audience check in the Admin API

     Show description for 01b32ce
     pedroigor

     committed
     01b32ceView commit details

     Copy full SHA for 01b32ce

     View code at this pointBrowse repository at this point

   • Prevent Vault secret resolution and injection in DCR client secrets (#54463)

     Show description for df2914e
     jimmychakkalakal

     authored
     df2914eView commit details

     Copy full SHA for df2914e

     View code at this pointBrowse repository at this point

   • Return invalid_request for malformed device authorization requests

     Show description for 50273e1
     

     shlee1223

     authored and

     mposolda

     committed
     50273e1View commit details

     Copy full SHA for 50273e1

     View code at this pointBrowse repository at this point
4. Commits on Nov 6, 2026

   • Make OIDCIdentityProvider.BROKER_NONCE_PARAM public

     Show description for d4d5554
     QuellcodeWanderer

     authored
     d4d5554View commit details

     Copy full SHA for d4d5554

     View code at this pointBrowse repository at this point

   • Remove ability to set up multivalued issuer for OIDC providers

     Show description for a9d7e41
     

     vramik

     authored and

     pedroigor

     committed
     a9d7e41View commit details

     Copy full SHA for a9d7e41

     View code at this pointBrowse repository at this point

   • Escape delimiter in federated and composite cache keys to prevent collisions

     Show description for 90b3f7e
     

     sguilhen

     authored and

     pedroigor

     committed
     90b3f7eView commit details

     Copy full SHA for 90b3f7e

     View code at this pointBrowse repository at this point

   • Reject a different brokered user on forced re-authentication before creating it

     Show description for 6ea53a2
     

     sguilhen

     authored and

     pedroigor

     committed
     6ea53a2View commit details

     Copy full SHA for 6ea53a2

     View code at this pointBrowse repository at this point

   • Reject online refresh tokens for sessions in logout states

     Show description for b1182f9
     

     lhanusov

     authored and

     mposolda

     committed
     b1182f9View commit details

     Copy full SHA for b1182f9

     View code at this pointBrowse repository at this point

   • Fix crash and inconsistent matching in account console linked-accounts search

     Show description for 77a8f12
     

     sguilhen

     authored and

     pedroigor

     committed
     77a8f12View commit details

     Copy full SHA for 77a8f12

     View code at this pointBrowse repository at this point

   • Validate ECDSA signature length before JWS verification (#53928)

     Show description for ea78b16
     naruto-lgtm

     authored
     ea78b16View commit details

     Copy full SHA for ea78b16

     View code at this pointBrowse repository at this point

   • Always validate post-logout redirect URIs in SecureRedirectUrisEnforcerExecutor (#53038)

     Show description for baf4aaa
     

     jimmychakkalakal

     and

     Copilot

     authored
     baf4aaaView commit details

     Copy full SHA for baf4aaa

     View code at this pointBrowse repository at this point

   • [CVE-2026-116468] Privilege escalation: delegated admin to realm-admin via group move (incomplete fix of CVE-2026-94000)

     Show description for 1316705
     

     martin-kanis

     authored and

     pedroigor

     committed
     1316705View commit details

     Copy full SHA for 1316705

     View code at this pointBrowse repository at this point
5. Commits on Nov 5, 2026

   • Add validation for blocked session note names in UserSessionNoteMapper (#53559)

     Show description for ae5e730
     jimmychakkalakal

     authored
     ae5e730View commit details

     Copy full SHA for ae5e730

     View code at this pointBrowse repository at this point

   • Resolve ABCA attester key from x5c JOSE header

     Show description for f2d2da5
     

     adityaanikam

     authored and

     mposolda

     committed
     f2d2da5View commit details

     Copy full SHA for f2d2da5

     View code at this pointBrowse repository at this point

   • Do not log ABCA client authentication headers

     Show description for e0b49a7
     

     wakqasahmed

     authored and

     mposolda

     committed
     e0b49a7View commit details

     Copy full SHA for e0b49a7

     View code at this pointBrowse repository at this point

   • Forged authorization code lets any client detach another client's client session

     Show description for 98c6275
     

     graziang

     authored and

     mposolda

     committed
     98c6275View commit details

     Copy full SHA for 98c6275

     View code at this pointBrowse repository at this point