security
Articles about security from the Skycloak team.
CVE-2026-107121: Keycloak SMTP StartTLS Plaintext Downgrade
Keycloak 26.8.1 fixes CVE-2026-107121: realm SMTP with StartTLS on could still send credentials in plaintext. What changed, who is affected,…
8 min readKeycloak CVE-2026-103884: X.509 CRL Path Traversal When CRL Checking Is On
CVE-2026-103884 lets a crafted client certificate steer Keycloak's X.509 CRL loader outside its conf directory. Who is exposed, the real…
12 min readWhat Is Account Takeover (ATO)? How SaaS Teams Detect and Prevent It
Account takeover (ATO) means an attacker controls a real user's account. How it differs from a breach, the seven entry…
14 min readSession Hijacking: Why MFA Doesn't Save a Stolen Session
Session hijacking uses a stolen cookie or token, so MFA never fires. How infostealers do it, what limits the damage,…
8 min readWhat Is Credential Stuffing? Vs Brute Force, and How to Stop It
Credential stuffing replays leaked username and password pairs against your login. How it differs from brute force, what to watch…
7 min readBetter Auth 1.7.7: OAuth State vs Magic-Link Tokens
Better Auth 1.7.7 stops OAuth state values being redeemed as magic-link tokens. What went wrong, how to upgrade, and how…
11 min readCVE-2026-5430: WSO2 JWT Bypass and Your Keycloak APIs
CVE-2026-5430 let forged JWTs past WSO2 API Manager authentication. Here is how you pin algorithms and fail closed on APIs…
12 min readMCP Python SDK OAuth Flaw: Pin the Issuer on Keycloak
MCP OAuth flaw GHSA-qx49-fqc8-xw99: a malicious server could steal client secrets and PKCE verifiers from the MCP Python SDK. Upgrade,…
12 min readCVE-2026-100606: Flowise SSO Invite Takeover and IdP Checks
CVE-2026-100606 lets anyone who signs in with an invitee's email take over a pending Flowise Enterprise invite. How it works…
9 min readJADEPUFFER and Storm-3168: Retire Static Keycloak Secrets
Storm-3168 (JADEPUFFER) wiped Azure resources with compromised service principals. How the same client secret risk looks on Keycloak, and how…
12 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.