security
Articles about security from the Skycloak team.
The US CLOUD Act and Your Keycloak Data: What It Actually Reaches
The CLOUD Act follows the provider, not the datacentre. What that means for Keycloak in the EU, and the questions…
12 min readCVE-2026-17526: Keycloak Impersonation Escalates to Realm Admin
CVE-2026-17526 let a Keycloak impersonation-role holder take over a realm admin. Fixed in 26.7.4 on 16 September 2026, and on…
8 min readMFA Fatigue and Keycloak: The Real Risk Is Enrollment Abuse
Keycloak 26.x ships no push authenticator, so MFA fatigue lands differently here. The exposure that matters is authenticator enrollment, and…
8 min readShadow AI Agents: Okta's Endpoint Scan vs Keycloak Inventory
Okta widened shadow AI agent discovery at Oktane 2026. Keycloak has no endpoint scanner, but it owns the chokepoint where…
9 min readCVE-2026-59822: LiteLLM's MCP Auth Bypass, and the Second Bug in the Same Fix
CVE-2026-59822 let any fabricated Bearer token open a LiteLLM MCP session. The two separate bugs one pull request closed, and…
11 min readCVE-2026-93999: Keycloak Refresh Restores a Disabled Audience
Keycloak checks an audience client is enabled during token exchange, but not when that refresh token is used. What CVE-2026-93999…
8 min readDevice Code Phishing and Passkey Lures: Harden Keycloak Against AiTM
Microsoft's September 2026 report shows passkey-themed lures driving AiTM and device-code attacks. Here is the Keycloak realm hardening that answers…
12 min readCVE-2026-17048: Keycloak's Admin REST API Can Hand Back a Vault-Resolved Client Secret
CVE-2026-17048 lets a view-only Keycloak admin read the plaintext of a vault-backed rotated client secret. CVSS 5.5, fixed in 26.7.2…
9 min readCVE-2026-88770: Keycloak's Device Flow Can Still Issue Tokens for a Locked Account
CVE-2026-88770 lets Keycloak's device authorization grant redeem tokens for an account brute-force protection already locked. CVSS 6.5, no patch yet.
8 min readCVE-2026-18963: The Keycloak Password Reset Takeover, and Which Versions Fix It
CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the reset-credentials flow. CVSS 9.1. Three release lines carry…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.