Daily Dev Stack Digest — September 15, 2026: Keycloak's Critical Auth-Bypass Chain, Next.js 16.3.5, and a Docker CVE Patch

Executive Summary

• Keycloak: a four-CVE chain (password-reset bypass, ROPC bypass, org-scope token disclosure, and an unpatched first-broker-login flaw) lets attackers take over accounts without ever clicking a verification link.
• Docker Desktop shipped fixes for CVE-2026-17106 alongside Buildx and Scout CLI updates; Docker Engine 29.8.0 adds a container umask option and hardens AppArmor/AF_VSOCK policy.
• Next.js 16.3.5 landed as a backport bugfix release (Turbopack worker-chunk loading, resolve-key handling, remote cache auth) alongside a 16.4.0 canary with experimental chunking controls.
• SvelteKit 3 reached Release Candidate status and Svelte 5.57 shipped new SvelteMap methods, while the sv CLI swapped its old mcp add-on for a new ai-tools add-on.
• Cloudflare quietly shortened Workflows instance-state retention from 30 days to 7 days by default for instances created after September 10 — an operational change worth checking against any audit or debugging tooling that reads old instance history.
• Database patch trains kept moving: MongoDB 8.0.29 closes out a batch of CVEs, Redis 8.10.1 is a security release, and ClickHouse 26.8 landed as the new LTS.

Identity & Auth: Keycloak's Account-Takeover Chain

The biggest story in today's audit is on the identity side. Security researchers disclosed a chain of Keycloak vulnerabilities that, combined, let an unauthenticated attacker take over arbitrary accounts. The most severe, CVE-2026-18963, is an authentication bypass in the reset-credentials flow: Keycloak lets an attacker force a password reset and set new credentials directly, without the victim ever clicking the mandated email verification link.

A second bug, CVE-2026-9792, bypasses a configured deny policy on the Resource Owner Password Credentials (ROPC) grant — the token endpoint issues valid tokens even when ROPC is explicitly disabled for a client. A third, CVE-2026-9791, is an incorrect-authorization flaw where a user with existing organization membership can request an OIDC token with the organization scope and get org metadata disclosed even after that feature has been turned off.

A fourth issue, CVE-2026-82968, affects first-broker-login social account linking: an attacker with their own account on the same social identity provider can intercept the linking process and reach the victim's local Keycloak profile. As of September 11, 2026 there was no patched release for this one — teams running social login through Keycloak should review the mitigation guidance in the advisory rather than wait for a point release.

Recommended action

• Patch to the latest Keycloak release that addresses CVE-2026-18963, CVE-2026-9792, and CVE-2026-9791 immediately, and audit password-reset and ROPC logs for anomalous activity in the interim.
• For CVE-2026-82968, disable or tightly scope automatic account linking on social identity providers until a fix ships.

Further reading: The Hacker News coverage of the password-reset flaw and the GitHub Advisory Database entry for CVE-2026-9791.

Meta-Frameworks: Next.js 16.3.5 and SvelteKit 3 RC

On the React side, Next.js 16.3.5 shipped as a backport bugfix release: app-entry validation is now scoped correctly to the app directory, a catch-all index routing bug is fixed, and Turbopack picked up several fixes around worker chunk loading, resolve request keys, and remote-cache authentication. As of September 12, 2026 a 16.4.0-canary is also available with experimental chunking controls aimed at improving navigation performance by sharing code across pages.

// next.config.js — experimental chunking controls (16.4.0-canary)
module.exports = {
  experimental: {
    optimizePackageImports: true, // share chunks across pages
  },
}

On the Svelte side, Svelte 5.57 added new SvelteMap methods and quality-of-life fixes, while SvelteKit 3 moved to Release Candidate status. The sv CLI replaced its old mcp add-on with a new ai-tools add-on, and sv@next now ships a task-based migration path for existing apps moving to SvelteKit 3. The stable 2.x line also kept shipping patches (2.70.1 through 2.70.3) for teams not ready to move to the RC.

Containers, Edge & Infrastructure

Docker Desktop's latest round of releases fixed startup, networking, installer, and virtualization issues, including CVE-2026-17106, alongside updates to the Buildx and Scout CLIs and improved Docker VMM Beta performance. Separately, Docker Compose v5.5.1 went out on September 3.

Docker Engine 29.8.0 is worth a closer look for platform teams: it adds a umask option for containers, expands awslogs driver attributes for better log observability, and strengthens container security with tighter AppArmor profile configuration and new policy to block AF_VSOCK abuse.

# Docker Engine 29.8.0 — set a umask for a container's processes
docker run --umask=0027 myimage

On the edge, Cloudflare Workers added Durable Object-managed Containers and idempotent application setup to the Wrangler deploy flow, plus safer versions-deploy behavior. More notably for anyone running long-lived Workflows: instances created on or after September 10, 2026 on the Workers Paid plan now retain completed/errored instance state for 7 days by default, down from 30 — worth checking if any debugging or compliance tooling assumes the old retention window.

Vercel made AWS PrivateLink generally available for private network connections to AWS-hosted databases from Vercel deployments, and added Anthropic's Claude Fable 5.1 to the AI Gateway with a single API key, automatic fallbacks, spend tracking, and per-request traces.

Databases, Caching & ORMs

ClickHouse 26.8 shipped as the new LTS on September 1, introducing background queries, pipelined SQL execution, new text tokenizers, expanded data-lake integrations, and faster Parquet, aggregation, and join performance.

On the security-patch side: MongoDB 8.0.29 closes out a batch of CVEs (CVE-2026-18687 through CVE-2026-18712), and Redis 8.10.1 is a dedicated security update. PostgreSQL's most recent maintenance round (18.6, 17.11, 16.15, 15.19, 14.24, plus a 19 Beta 3) remains the latest available — worth a reminder to confirm you're on a patched minor version across all five supported major branches.

On the ORM side, Prisma 8 now runs a stock Supabase project end-to-end via the new @prisma/orm-extension-supabase package and adds Row-Level Security policy authoring directly in the Prisma schema and in TypeScript. Drizzle ORM added an .if() helper usable on any WHERE expression for conditional query building, and fixed internal session mapping for .all(), .values(), and .execute() under the AWS Data API driver.

// Drizzle ORM — conditional WHERE with the new .if() helper
const users = await db
  .select()
  .from(usersTable)
  .where((eb) => eb.and(
    eb(usersTable.active, true),
    eb.if(searchTerm, eb.ilike(usersTable.name, `%${searchTerm}%`)),
  ));

Also Tracked, No Major Changes Today

Laravel continues shipping incremental framework updates (a WorkerStopping connection/queue event, Eloquent insertOrIgnoreReturning, vector index drops, and Microsoft SQL Server DSN support) rather than a single headline release. Material UI, RabbitMQ (stable at 4.3.2), Apache Kafka (stable at 4.2.0), and BullMQ (6.2.0) all remain on their current stable lines with no security-relevant releases surfaced in today's scan. DuckDB's latest stable is still 1.5.2. We'll flag any of these the moment a security advisory or major version lands.