Tag

cve

Articles tagged with cve.

security

CVE-2026-93999: Keycloak Refresh Restores a Disabled Audience

Keycloak checks an audience client is enabled during token exchange, but not when that refresh token is used. What CVE-2026-93999…

Guilliano MolaireGuilliano Molaire8 min read
security

CVE-2026-17048: Keycloak's Admin REST API Can Hand Back a Vault-Resolved Client Secret

CVE-2026-17048 lets a view-only Keycloak admin read the plaintext of a vault-backed rotated client secret. CVSS 5.5, fixed in 26.7.2…

Guilliano MolaireGuilliano Molaire9 min read
security

CVE-2026-88770: Keycloak's Device Flow Can Still Issue Tokens for a Locked Account

CVE-2026-88770 lets Keycloak's device authorization grant redeem tokens for an account brute-force protection already locked. CVSS 6.5, no patch yet.

Guilliano MolaireGuilliano Molaire8 min read
security

CVE-2026-18963: Keycloak Reset Takeover, PoC and Patches

CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account via reset. Public exploit code exists. Fixed in 26.4.15, 26.6.6…

Guilliano MolaireGuilliano Molaire16 min read
security

CVE-2026-82968: Hardening Keycloak First-Broker Login While the Fix Is Pending

CVE-2026-82968 lets an attacker on the same social provider intercept Keycloak account linking. CVSS 6.4, no patched release yet. What…

Guilliano MolaireGuilliano Molaire8 min read
security

Keycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist

Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…

Guilliano MolaireGuilliano Molaire9 min read
security

Keycloak LDAP Certificate Validation: What CVE-2026-35563 Actually Affects

CVE-2026-35563 is scoped to a Keycloak test dependency, not LDAP user federation. Here is what really governs LDAP certificate validation…

Guilliano MolaireGuilliano Molaire7 min read
security

CVE-2026-16072 and CVE-2026-18201: Two Keycloak Organization Permission Gaps

Two moderate Keycloak CVEs let admins act outside their permissions on organizations. What they allow, who is affected, and what…

Guilliano MolaireGuilliano Molaire7 min read
Keycloak SAML Security: Vulnerabilities and Hardening
best-practices

Keycloak SAML Security: Vulnerabilities and Hardening

Explore Keycloak SAML security vulnerabilities including CVE-2024-8698, XML wrapping attacks, and assertion replay, with hardening steps.

Guilliano MolaireGuilliano Molaire11 min read

Stay ahead on identity & security

Get tutorials, product updates, and Keycloak tips delivered to your inbox.

Start Free TrialTalk to Sales
© 2026 Skycloak. All Rights Reserved. Design by Yasser SolimanKeycloak™ is a trademark of the Linux Foundation. Skycloak is not affiliated with the Keycloak project.