Blog

Insights on Identity, Security & Keycloak

Tutorials, deep dives, and best practices from the Skycloak team.

security Latest

CVE-2026-97846: Keycloak Token Exchange Drops mTLS Binding

CVE-2026-97846 lets Keycloak standard token exchange issue an unbound Bearer token for an mTLS-bound client. What it breaks, who is exposed, what to do now.

Guilliano Molaire Guilliano Molaire 11 min read
security

CVE-2026-97176: Keycloak Step-Up Authentication Bypass

CVE-2026-97176 can let Keycloak issue a token at a lower assurance level than a client's essential acr demands, skipping step-up.…

Guilliano Molaire Guilliano Molaire 9 min read
security

CVE-2026-97177: Keycloak Delegated Admin Account Takeover

CVE-2026-97177 enables account takeover in Keycloak: a delegated admin denied reset-password can still set passwords via user update. How it…

Guilliano Molaire Guilliano Molaire 9 min read
security

CVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS

CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…

Guilliano Molaire Guilliano Molaire 10 min read
security-best-practices

TrustSink: Rogue External MFA and Phishing-Resistant Login

TrustSink turns a rogue Entra external MFA provider into a password trap after an admin compromise. What it needs, why…

Guilliano Molaire Guilliano Molaire 10 min read
best-practices

What Vendor Security Questionnaires Ask About Login

Login is one of the biggest sections of a vendor security questionnaire. What the SSO, MFA, access review, audit log…

Guilliano Molaire Guilliano Molaire 9 min read
Tutorials

Add Skycloak to Cursor with MCP: Operate Managed Keycloak from Your IDE

Connect Cursor to the Skycloak MCP server at mcp.skycloak.io, sign in with browser OAuth, and manage Keycloak clusters, realms, apps…

Guilliano Molaire Guilliano Molaire 4 min read
security

Harden Keycloak with Claude Code and Cursor: An AI-Assisted Security Review Playbook

Use Claude Code or Cursor to review Keycloak realm exports safely: redact secrets, catch PKCE and audience mistakes, and keep…

Guilliano Molaire Guilliano Molaire 4 min read
security

CVE-2026-95503: Keycloak Kerberos Does Not Verify the KDC

CVE-2026-95503 lets an adjacent-network attacker spoof the KDC when Keycloak does Kerberos password authentication without SPNEGO. No fixed release yet.

Guilliano Molaire Guilliano Molaire 10 min read
comparisons

Resource Access Certifications for AI Agents vs Keycloak

Okta shipped Resource Access Certifications for AI agents on 22 September 2026. What the control does, and how to run…

Guilliano Molaire Guilliano Molaire 11 min read
1 2 3 … 38

Stay ahead on identity & security

Get tutorials, product updates, and Keycloak tips delivered to your inbox.

Start Free Trial Talk to Sales
© 2026 Skycloak. All Rights Reserved. Design by Yasser Soliman