keycloak
Articles tagged with keycloak.
CVE-2026-97177: Keycloak Delegated Admin Account Takeover
CVE-2026-97177 enables account takeover in Keycloak: a delegated admin denied reset-password can still set passwords via user update. How it…
9 min readCVE-2026-97846: Keycloak Token Exchange Drops mTLS Binding
CVE-2026-97846 lets Keycloak standard token exchange issue an unbound Bearer token for an mTLS-bound client. What it breaks, who is…
11 min readCVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS
CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…
10 min readTrustSink: Rogue External MFA and Phishing-Resistant Login
TrustSink turns a rogue Entra external MFA provider into a password trap after an admin compromise. What it needs, why…
10 min readWhat Vendor Security Questionnaires Ask About Login
Login is one of the biggest sections of a vendor security questionnaire. What the SSO, MFA, access review, audit log…
9 min readAdd Skycloak to Cursor with MCP: Operate Managed Keycloak from Your IDE
Connect Cursor to the Skycloak MCP server at mcp.skycloak.io, sign in with browser OAuth, and manage Keycloak clusters, realms, apps…
4 min readHarden Keycloak with Claude Code and Cursor: An AI-Assisted Security Review Playbook
Use Claude Code or Cursor to review Keycloak realm exports safely: redact secrets, catch PKCE and audience mistakes, and keep…
4 min readCVE-2026-95503: Keycloak Kerberos Does Not Verify the KDC
CVE-2026-95503 lets an adjacent-network attacker spoof the KDC when Keycloak does Kerberos password authentication without SPNEGO. No fixed release yet.
10 min readResource Access Certifications for AI Agents vs Keycloak
Okta shipped Resource Access Certifications for AI agents on 22 September 2026. What the control does, and how to run…
10 min readSecure Your App with AI: What AI AppSec Can and Cannot Replace in IAM
AI coding agents find bugs and bad configs. They do not replace token issuance, audience checks, step-up, or revocation. Here…
4 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.