Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
Authentication vs Authorization: Why Valid Logins Get 403
Authentication proves who is calling, authorization decides what they may do. See a Keycloak token pass every check and still…
18 min readPHP2Shell (CVE-2026-109618): Patch PHP, Rotate Login Secrets
PHP2Shell (CVE-2026-109618, CVE-2026-109619): unauthenticated RCE in PHP. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. Patch order, mitigations, what to rotate.
22 min readOne Login Form, Three Systems: Retrofitting Keycloak into a Legacy PHP Monolith
How a 12-year-old PHP monolith and LimeSurvey got one Keycloak user store without a new login form: migrate on login,…
9 min readApache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readAuth0 vs Amazon Cognito (2026): CIAM Compared After Cognito Adds Step-Up and ACR/AMR Claims
Auth0 vs Amazon Cognito after Cognito added step-up and ACR/AMR token claims on 2 Oct 2026: features, billing models, lock-in…
11 min readMCP Filesystem Capability Laundering: When a Harmless Tool Can Read Your SSH Keys
MCP server security: a 2026 study flagged 787 of 4,806 servers for hidden file access. Covers Filesystem MCP Server path…
12 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readWhat Is a Service Principal? How Vendor Apps Get App-Only Access
A service principal is an app's identity inside one tenant. See how vendor apps get app-only access, how to audit…
11 min readKeycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.