Articles by Guilliano Molaire
Apache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readAuth0 vs Amazon Cognito (2026): CIAM Compared After Cognito Adds Step-Up and ACR/AMR Claims
Auth0 vs Amazon Cognito after Cognito added step-up and ACR/AMR token claims on 2 Oct 2026: features, billing models, lock-in…
11 min readMCP Filesystem Capability Laundering: When a Harmless Tool Can Read Your SSH Keys
MCP server security: a 2026 study flagged 787 of 4,806 servers for hidden file access. Covers Filesystem MCP Server path…
12 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readWhat Is a Service Principal? How Vendor Apps Get App-Only Access
A service principal is an app's identity inside one tenant. See how vendor apps get app-only access, how to audit…
11 min readKeycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readJWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min readWhat Is a JWT Token? Structure, Claims and Signatures
A JWT token is a signed Base64URL string with a header, payload and signature. What each part holds, which claims…
12 min readWhat Is Entitlement Management? Entitlements vs Roles Explained
Entitlement management controls who holds which specific permission in which system, and for how long. Entitlements vs roles, and where…
10 min read