security
Articles about security from the Skycloak team.
CVE-2026-16072 and CVE-2026-18201: Two Keycloak Organization Permission Gaps
Two moderate Keycloak CVEs let admins act outside their permissions on organizations. What they allow, who is affected, and what…
7 min read
Keycloak LDAP Certificate Validation: What CVE-2026-35563 Actually Affects
CVE-2026-35563 is scoped to a Keycloak test dependency, not LDAP user federation. Here is what really governs LDAP certificate validation…
7 min read
Keycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
9 min read
SPIFFE/SPIRE Workload Identity: What a Compromised Node Actually Breaks
Unit 42 showed a root-compromised Kubernetes node can spoof SPIFFE/SPIRE workload identities via cgroup tricks. Here is what actually breaks,…
11 min read
Loi 25 et PIPEDA : ce que la conformité exige de votre système d’identité
Ce que la Loi 25 et la LPRPDE exigent de votre gestion des identités, où vos données doivent résider, et…
9 min read
Keycloak, Quebec Law 25 and PIPEDA: A Practical Compliance Guide
What Quebec's Law 25 and PIPEDA require from your identity system, which Keycloak settings satisfy them, and the data residency…
9 min read
Skycloak Is Now HIPAA-Compliant: HIPAA-Ready Managed Keycloak for Healthcare
Skycloak is now HIPAA-compliant and BAA-ready. Run managed Keycloak for healthcare workloads with encryption, MFA, audit logging, and a signed…
4 min read
What Is HIPAA Compliance? A Complete Guide for 2026
HIPAA compliance means meeting the U.S. rules that protect health data. Learn the HIPAA rules, who must comply, what PHI…
9 min read
Keycloak Password Policy Best Practices
Keycloak password policies the modern way: length over complexity, breached-password and blacklist checks, hashing iterations, and per-realm enforcement.
9 min read
Session Management: Cookies vs Tokens vs Server-Side
Cookies vs tokens vs server-side sessions for distributed systems: security trade-offs, 2026 cookie changes, and how Keycloak persists sessions by…
11 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.