keycloak
Articles tagged with keycloak.
Apache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readAuth0 vs Amazon Cognito (2026): CIAM Compared After Cognito Adds Step-Up and ACR/AMR Claims
Auth0 vs Amazon Cognito after Cognito added step-up and ACR/AMR token claims on 2 Oct 2026: features, billing models, lock-in…
11 min readMCP Filesystem Capability Laundering: When a Harmless Tool Can Read Your SSH Keys
MCP server security: a 2026 study flagged 787 of 4,806 servers for hidden file access. Covers Filesystem MCP Server path…
12 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readWhat Is a Service Principal? How Vendor Apps Get App-Only Access
A service principal is an app's identity inside one tenant. See how vendor apps get app-only access, how to audit…
11 min readKeycloak CIBA Lockout Fix: Brute-Force Check Added to Token Redemption
Keycloak 26.7.5 closes a gap where a locked-out user's approved CIBA request could be redeemed for tokens. Who is affected,…
7 min readOAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readJWT sub Claim Explained: Unique Only Per Issuer
The JWT sub claim identifies a user only within one issuer. Why your key must be iss plus sub, why…
8 min readWhat Is Entitlement Management? Entitlements vs Roles Explained
Entitlement management controls who holds which specific permission in which system, and for how long. Entitlements vs roles, and where…
10 min readIAM vs PAM: Differences, Overlap and Which You Need First
IAM vs PAM: IAM manages sign-in for everyone, PAM protects the few powerful accounts. Where they overlap and which a…
5 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.