keycloak
Articles tagged with keycloak.
Keycloak Native SCIM API Preview in 26.7: What It Covers, What It Misses, and When Managed Still Wins
Keycloak 26.7 promotes its native SCIM API to preview behind the scim-api flag. It handles CRUD, PATCH and filtering, but…
9 min read
CVE-2026-88770: Keycloak’s Device Flow Can Still Issue Tokens for a Locked Account
CVE-2026-88770 lets Keycloak's device authorization grant redeem tokens for an account brute-force protection already locked. CVSS 6.5, no patch yet.
8 min read
CVE-2026-18963: The Keycloak Password Reset Takeover, and Which Versions Fix It
CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the reset-credentials flow. CVSS 9.1. Three release lines carry…
10 min read
CVE-2026-82968: Hardening Keycloak First-Broker Login While the Fix Is Pending
CVE-2026-82968 lets an attacker on the same social provider intercept Keycloak account linking. CVSS 6.4, no patched release yet. What…
8 min read
Keycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
9 min read
Keycloak LDAP Certificate Validation: What CVE-2026-35563 Actually Affects
CVE-2026-35563 is scoped to a Keycloak test dependency, not LDAP user federation. Here is what really governs LDAP certificate validation…
7 min read
CVE-2026-16072 and CVE-2026-18201: Two Keycloak Organization Permission Gaps
Two moderate Keycloak CVEs let admins act outside their permissions on organizations. What they allow, who is affected, and what…
7 min read
Keycloak Authentication Error Handling: Custom Error Pages
Customize Keycloak error pages, handle OAuth/OIDC errors in your app, and configure brute force protection for secure, user-friendly authentication.
11 min read
How Many Nines Does Your Keycloak SLA Actually Need?
Four nines vs five nines for authentication: what each SLA tier really costs, which Keycloak architecture delivers it, and when…
5 min read
Migrating From Azure AD B2C to Keycloak
Migrate from Azure AD B2C to Keycloak: export users and custom policies, recreate user flows as authentication flows, handle password…
11 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.