Guilliano Molaire
Founder at Skycloak
Guilliano is the founder of Skycloak and a cloud infrastructure specialist with deep expertise in product development and scaling SaaS products. He discovered Keycloak while consulting on enterprise IAM and built Skycloak to make managed Keycloak accessible to teams of every size.
Articles by Guilliano Molaire
TrustSink: Rogue External MFA and Phishing-Resistant Login
TrustSink turns a rogue Entra external MFA provider into a password trap after an admin compromise. What it needs, why…
What Vendor Security Questionnaires Ask About Login
Login is one of the biggest sections of a vendor security questionnaire. What the SSO, MFA, access review, audit log…
Add Skycloak to Cursor with MCP: Operate Managed Keycloak from Your IDE
Connect Cursor to the Skycloak MCP server at mcp.skycloak.io, sign in with browser OAuth, and manage Keycloak clusters, realms, apps…
Harden Keycloak with Claude Code and Cursor: An AI-Assisted Security Review Playbook
Use Claude Code or Cursor to review Keycloak realm exports safely: redact secrets, catch PKCE and audience mistakes, and keep…
CVE-2026-95503: Keycloak Kerberos Does Not Verify the KDC
CVE-2026-95503 lets an adjacent-network attacker spoof the KDC when Keycloak does Kerberos password authentication without SPNEGO. No fixed release yet.
Resource Access Certifications for AI Agents vs Keycloak
Okta shipped Resource Access Certifications for AI agents on 22 September 2026. What the control does, and how to run…
The Vendor Risk Brief Your CTO Needs to See
A one-page identity vendor risk brief: the three risks worth five minutes of a CTO's time, the one question to…
Secure Your App with AI: What AI AppSec Can and Cannot Replace in IAM
AI coding agents find bugs and bad configs. They do not replace token issuance, audience checks, step-up, or revocation. Here…
CVE-2026-17526: Keycloak Impersonation Escalates to Realm Admin
CVE-2026-17526 let a Keycloak impersonation-role holder take over a realm admin. Fixed in 26.7.4 on 16 September 2026, and on…
MFA Fatigue and Keycloak: The Real Risk Is Enrollment Abuse
Keycloak 26.x ships no push authenticator, so MFA fatigue lands differently here. The exposure that matters is authenticator enrollment, and…