Keycloak v26.7.4: 6 CVEs — migrate to Authelia or ZITADEL

Keycloak v26.7.4 — why 6 CVEs in one week change the picture

What each CVE could have allowed — plain-language summary

• CVE-2026-79651 (CVSS 7.5 — high): Keycloak accepts arbitrary locale tags on theme endpoints with no bounding or validation. An attacker loops unique locales from the public network; each request allocates memory that is never freed. Result: process crash via memory exhaustion, with zero user credentials required.
• CVE-2026-18212 (CVSS 7.5 — high): SAML Redirect DEFLATE helpers leak native zlib state. A malformed SAML request is enough to trigger memory corruption that can lead to a server crash or session data leak.
• CVE-2026-74909 (CVSS 8.1 — high): a percent-encoded semicolon (%3B) bypasses matrix-parameter stripping in PathMatcher. An attacker can reach a resource protected by a stricter policy by using the less-restrictive form of the same route.
• CVE-2026-90997 (CVSS 7.4 — high): on MySQL or MariaDB deployments, default row counts returned by the storage engine make anti-replay gates ineffective. A previously used authentication artifact can be reused.
• CVE-2026-17526 (CVSS 7.2 — high): the impersonation role can impersonate a realm administrator. An operator with limited permissions can elevate their privileges to full realm administration.
• CVE-2026-19607 (CVSS 5.3 — medium): a username collision in the identity federation (broker) flow locks the legitimate user out of their own account without any action on their part.

Keycloak vs Authelia vs ZITADEL — choosing for your VPS context

Scroll the table

Authelia — lightweight SSO for fewer than 10 applications

Migrating from Keycloak to Authelia — OIDC export, config, tests

1. 01

   Export your OIDC configuration from Keycloak

   In the Keycloak admin console, go to Realm Settings → Export. Check "Export clients" and "Export groups". Download the resulting JSON — it contains your OIDC clients with their redirect URIs and scopes. This file serves as a reference for reconfiguring each application in Authelia; it is not imported directly.

2. 02

   Install Authelia with Docker Compose

   Create a minimal docker-compose.yml:

   services:
authelia:
image: authelia/authelia:latest
volumes:
- ./config:/config
ports:
- 9091:9091
restart: unless-stopped

   Create the config/ directory and place configuration.yml inside it. The official documentation provides a complete skeleton at https://www.authelia.com/configuration/prologue/introduction/.

3. 03

   Configure OIDC clients in Authelia

   For each application migrated from Keycloak, add an entry under identity_providers.oidc.clients in configuration.yml:

   identity_providers:
oidc:
clients:
- id: my-app
secret: '$pbkdf2-sha512$...'
redirect_uris:
- https://my-app.example.com/oauth/callback
scopes: [openid, email, profile]

   Generate the secret with authelia crypto hash generate pbkdf2 --variant sha512. Use the Keycloak export JSON to find each client's redirect URIs.

4. 04

   Configure your reverse proxy to query Authelia

   Authelia works as a validation middleware. In nginx, add an auth_request block:

   location /authelia {
internal;
proxy_pass http://authelia:9091/api/authz/forward-auth;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

   location / {
auth_request /authelia;
proxy_pass http://my-app:3000;
}

   For applications that use OIDC natively, point the issuer to https://auth.your-domain.com.

5. 05

   Test each application before cutting over from Keycloak

   For each migrated application, verify three flows: initial login (redirect to Authelia → authentication → return to app), logout (Authelia cookie and app session invalidated), and second factor if enabled (TOTP or WebAuthn). Only cut over from Keycloak once all flows for all applications are validated on Authelia. Keep the Keycloak container stopped but not deleted for 30 days to allow rollback.

ZITADEL — API-first identity provider for development teams

Migrating from Keycloak to ZITADEL — procedure on VPS

1. 06

   Deploy ZITADEL with Docker Compose

   ZITADEL provides an official docker-compose.yml in its GitHub repository (the e2e/ directory). The minimal configuration requires PostgreSQL (or CockroachDB) and a 32-character ZITADEL_MASTERKEY:

   ZITADEL_MASTERKEY=$(openssl rand -base64 32)

   Consult the official documentation at https://zitadel.com/docs/self-hosting/deploy/compose for the complete file and required environment variables.

2. 07

   Create OIDC applications in ZITADEL

   In the ZITADEL console (https://your-instance:8080), create an Organization, then a Project. Inside that project, create an Application of type "Web" or "User Agent" depending on your use case.

   ZITADEL generates a Client ID and Client Secret. Configure the Redirect URIs using your Keycloak export JSON as reference. The Discovery endpoint is at https://your-instance:8080/.well-known/openid-configuration.

3. 08

   Migrate users from Keycloak

   Keycloak can export users from a realm as JSON via the console (Realm Settings → Export → check "Export users"). Hashed passwords cannot be imported directly into ZITADEL — the hashing algorithms differ.

   Two approaches: (1) import user metadata via the ZITADEL API (POST /management/v1/users/human/_import) with forced password reset on first login, or (2) progressive migration via social/OIDC login (ZITADEL consumes Keycloak as an external IdP during the transition). Approach (2) avoids asking all users to reset their passwords on the same day.

4. 09

   Update your applications to point to ZITADEL

   Update environment variables for each application:

   OIDC_ISSUER=https://your-instance:8080
OIDC_CLIENT_ID=<zitadel-client-id>
OIDC_CLIENT_SECRET=<zitadel-client-secret>

   The Discovery endpoint allows most OIDC libraries to self-configure. Test each application with a test account before switching production traffic.

5. 10

   Validate SSO flows and disable Keycloak

   Verify login, logout, token refresh, and second factor on each application. In ZITADEL, the "Sessions" tab in the console lets you see active sessions in real time and invalidate them if needed.

   Keep the Keycloak container stopped but not deleted for 30 days. Delete it after this retention period.

Common mistakes during SSO migration

After migration — testing authentication for each application