Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
What Is Two-Factor Authentication? 2FA Methods Compared by Real Attacks
Two-factor authentication asks for two kinds of proof at login. Compare SMS, app codes, push, passkeys and security keys against…
15 min readBeyondTrust CVE-2026-102764: Patch, Audit, Rotate
CVE-2026-102764 is an exploited auth bypass in BeyondTrust Remote Support 26.2.3 and earlier. Patch BT26-05, then what to audit and…
15 min readeMudhra CA Distrust: Audit Your Login TLS Certificates Now
Browsers distrust eight eMudhra intermediate CAs and an emSign root. Check login, OIDC and SAML endpoints and the Keycloak truststore;…
16 min readKeycloak Client Authentication Without Secrets: Signed JWT (private_key_jwt)
Replace Keycloak client secrets with Signed JWT (private_key_jwt): the client signs a short assertion with its own key. Setup, code,…
9 min readAuthentication vs Authorization: Why Valid Logins Get 403
Authentication proves who is calling, authorization decides what they may do. See a Keycloak token pass every check and still…
18 min readPHP2Shell (CVE-2026-109618): Patch PHP, Rotate Login Secrets
PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated RCE in PHP. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Patch order, mitigations, what to rotate.
22 min readOne Login Form, Three Systems: Retrofitting Keycloak into a Legacy PHP Monolith
How a 12-year-old PHP monolith and LimeSurvey got one Keycloak user store without a new login form: migrate on login,…
9 min readApache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readAuth0 vs Amazon Cognito (2026): CIAM Compared After Cognito Adds Step-Up and ACR/AMR Claims
Auth0 vs Amazon Cognito after Cognito added step-up and ACR/AMR token claims on 2 Oct 2026: features, billing models, lock-in…
11 min readMCP Filesystem Capability Laundering: When a Harmless Tool Can Read Your SSH Keys
MCP server security: a 2026 study flagged 787 of 4,806 servers for hidden file access. Covers Filesystem MCP Server path…
12 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.