Guilliano Molaire

Guilliano Molaire

Founder at Skycloak

Guilliano is the founder of Skycloak and a cloud infrastructure specialist with deep expertise in product development and scaling SaaS products. He discovered Keycloak while consulting on enterprise IAM and built Skycloak to make managed Keycloak accessible to teams of every size.

432 articles publishedLinkedInGitHub
KeycloakProduct DevelopmentSaaSSingle Sign-OnOAuth 2.0SAMLAWS InfrastructureCloud Security

Articles by Guilliano Molaire

security

CVE-2026-97176: Keycloak Step-Up Authentication Bypass

CVE-2026-97176 can let Keycloak issue a token at a lower assurance level than a client's essential acr demands, skipping step-up.…

Guilliano MolaireGuilliano Molaire9 min read
security

CVE-2026-97177: Keycloak Delegated Admin Account Takeover

CVE-2026-97177 enables account takeover in Keycloak: a delegated admin denied reset-password can still set passwords via user update. How it…

Guilliano MolaireGuilliano Molaire9 min read
security

CVE-2026-97846: Keycloak Token Exchange Drops mTLS Binding

CVE-2026-97846 lets Keycloak standard token exchange issue an unbound Bearer token for an mTLS-bound client. What it breaks, who is…

Guilliano MolaireGuilliano Molaire11 min read
security

CVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS

CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…

Guilliano MolaireGuilliano Molaire10 min read
security-best-practices

TrustSink: Rogue External MFA and Phishing-Resistant Login

TrustSink turns a rogue Entra external MFA provider into a password trap after an admin compromise. What it needs, why…

Guilliano MolaireGuilliano Molaire10 min read
best-practices

What Vendor Security Questionnaires Ask About Login

Login is one of the biggest sections of a vendor security questionnaire. What the SSO, MFA, access review, audit log…

Guilliano MolaireGuilliano Molaire9 min read
Tutorials

Add Skycloak to Cursor with MCP: Operate Managed Keycloak from Your IDE

Connect Cursor to the Skycloak MCP server at mcp.skycloak.io, sign in with browser OAuth, and manage Keycloak clusters, realms, apps…

Guilliano MolaireGuilliano Molaire4 min read
security

Harden Keycloak with Claude Code and Cursor: An AI-Assisted Security Review Playbook

Use Claude Code or Cursor to review Keycloak realm exports safely: redact secrets, catch PKCE and audience mistakes, and keep…

Guilliano MolaireGuilliano Molaire4 min read
security

CVE-2026-95503: Keycloak Kerberos Does Not Verify the KDC

CVE-2026-95503 lets an adjacent-network attacker spoof the KDC when Keycloak does Kerberos password authentication without SPNEGO. No fixed release yet.

Guilliano MolaireGuilliano Molaire10 min read
comparisons

Resource Access Certifications for AI Agents vs Keycloak

Okta shipped Resource Access Certifications for AI agents on 22 September 2026. What the control does, and how to run…

Guilliano MolaireGuilliano Molaire10 min read
© 2026 Skycloak. All Rights Reserved. Design by Yasser SolimanKeycloak™ is a trademark of the Linux Foundation. Skycloak is not affiliated with the Keycloak project.