Guilliano Molaire
Founder at Skycloak
Guilliano is the founder of Skycloak and a cloud infrastructure specialist with deep expertise in product development and scaling SaaS products. He discovered Keycloak while consulting on enterprise IAM and built Skycloak to make managed Keycloak accessible to teams of every size.
Articles by Guilliano Molaire
Okta Agent Gateway vs Keycloak for MCP Authorization
Okta Agent Gateway puts policy inline between AI agents and MCP tools. Here is what it adds, and why MCP…
AWS Cognito Pricing as You Scale: Is It Still the Right Fit?
AWS Cognito pricing tracks monthly active users, and enterprise SSO users get a free tier of only 50. Three checks…
MCP Python SDK OAuth Flaw: Pin the Issuer on Keycloak
MCP OAuth flaw GHSA-qx49-fqc8-xw99: a malicious server could steal client secrets and PKCE verifiers from the MCP Python SDK. Upgrade,…
Why SSO Alone Won’t Pass a Vendor Security Review
SSO answers one line of a vendor security review. What reviewers also check: enforced SSO, deprovisioning, sessions, audit logs, and…
CVE-2026-100606: Flowise SSO Invite Takeover and IdP Checks
CVE-2026-100606 lets anyone who signs in with an invitee's email take over a pending Flowise Enterprise invite. How it works…
SOC 2 Type 1 vs Type 2: Which Do You Need First?
SOC 2 Type 1 vs Type 2: Type 1 checks control design on one date, Type 2 checks controls worked…
JADEPUFFER and Storm-3168: Retire Static Keycloak Secrets
Storm-3168 (JADEPUFFER) wiped Azure resources with compromised service principals. How the same client secret risk looks on Keycloak, and how…
CVE-2026-96448: Keycloak FGAP Composite Privilege Escalation
CVE-2026-96448 is a Keycloak privilege escalation: an FGAP v2 delegated admin assigns a composite role that hides realm-admin. How it…
Keycloak 26.7.4 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.4 fixes six CVEs, from a SAML memory leak to impersonation of realm admins. Which reach 26.6 and 26.4,…
CVE-2026-19607: Keycloak Username Takeover and Account Lockout
CVE-2026-19607: a brokered login whose email matches a Keycloak username shadows that user and locks them out. Fixed in 26.7.4.…