Guilliano Molaire
Founder at Skycloak
Guilliano is the founder of Skycloak and a cloud infrastructure specialist with deep expertise in product development and scaling SaaS products. He discovered Keycloak while consulting on enterprise IAM and built Skycloak to make managed Keycloak accessible to teams of every size.
Articles by Guilliano Molaire
Keycloak CIMD for MCP: Client ID Metadata Documents for Claude Code and VS Code
Keycloak has shipped experimental CIMD support since 26.6 behind the cimd flag. Here is the client policy that lets Claude…
CVE-2026-17048: Keycloak’s Admin REST API Can Hand Back a Vault-Resolved Client Secret
CVE-2026-17048 lets a view-only Keycloak admin read the plaintext of a vault-backed rotated client secret. CVSS 5.5, fixed in 26.7.2…
Agentic IAM in September 2026: What Okta Agent SSO, Ping, and JumpCloud Mean If You Run Keycloak
Okta, Ping and JumpCloud all shipped agentic IAM in the last three weeks. Here is what those launches actually add,…
Keycloak Native SCIM API Preview in 26.7: What It Covers, What It Misses, and When Managed Still Wins
Keycloak 26.7 promotes its native SCIM API to preview behind the scim-api flag. It handles CRUD, PATCH and filtering, but…
CVE-2026-88770: Keycloak’s Device Flow Can Still Issue Tokens for a Locked Account
CVE-2026-88770 lets Keycloak's device authorization grant redeem tokens for an account brute-force protection already locked. CVSS 6.5, no patch yet.
CVE-2026-18963: The Keycloak Password Reset Takeover, and Which Versions Fix It
CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the reset-credentials flow. CVSS 9.1. Three release lines carry…
CVE-2026-82968: Hardening Keycloak First-Broker Login While the Fix Is Pending
CVE-2026-82968 lets an attacker on the same social provider intercept Keycloak account linking. CVSS 6.4, no patched release yet. What…
Keycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
Keycloak LDAP Certificate Validation: What CVE-2026-35563 Actually Affects
CVE-2026-35563 is scoped to a Keycloak test dependency, not LDAP user federation. Here is what really governs LDAP certificate validation…
CVE-2026-16072 and CVE-2026-18201: Two Keycloak Organization Permission Gaps
Two moderate Keycloak CVEs let admins act outside their permissions on organizations. What they allow, who is affected, and what…