security
Articles about security from the Skycloak team.
Keycloak Client Authentication Without Secrets: Signed JWT (private_key_jwt)
Replace Keycloak client secrets with Signed JWT (private_key_jwt): the client signs a short assertion with its own key. Setup, code,…
9 min readPHP2Shell (CVE-2026-109618): Patch PHP, Rotate Login Secrets
PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated RCE in PHP. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Patch order, mitigations, what to rotate.
22 min readApache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readMCP Filesystem Capability Laundering: When a Harmless Tool Can Read Your SSH Keys
MCP server security: a 2026 study flagged 787 of 4,806 servers for hidden file access. Covers Filesystem MCP Server path…
12 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readKeycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readKeycloak 26.8.1 SAML Logout Fix: One Client Could End Another's Sessions
Keycloak 26.8.1 changes how SAML single logout treats a SessionIndex owned by another client. What the code did before, what…
6 min readWhat Is Password Spraying? vs Credential Stuffing, and How to Stop It
Password spraying tries a few common passwords on many accounts, so no lockout fires. How it differs from credential stuffing,…
6 min readWhat Is Session Fixation? How It Differs From Session Hijacking
Session fixation plants a known session ID before the victim logs in. How it differs from session hijacking, where it…
6 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.