security
Articles tagged with security.
OAuth Redirect URI Parser Confusion: Why PKCE Does Not Save You
PKCE in OAuth does not protect an auth code sent to the wrong host. How URL parsers disagree on OAuth…
8 min readKeycloak 26.7.4 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.4 fixes six CVEs, from a SAML memory leak to impersonation of realm admins. Which reach 26.6 and 26.4,…
10 min readCVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS
CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…
10 min readTrustSink: Rogue External MFA and Phishing-Resistant Login
TrustSink turns a rogue Entra external MFA provider into a password trap after an admin compromise. What it needs, why…
10 min readCVE-2026-17526: Keycloak Impersonation Escalates to Realm Admin
CVE-2026-17526 let a Keycloak impersonation-role holder take over a realm admin. Fixed in 26.7.4 on 16 September 2026, and on…
8 min readMFA Fatigue and Keycloak: The Real Risk Is Enrollment Abuse
Keycloak 26.x ships no push authenticator, so MFA fatigue lands differently here. The exposure that matters is authenticator enrollment, and…
8 min readKeycloak 26.7.3 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.3 fixes twenty CVEs across FGAP v2, OIDC and token exchange. What to re-test after you upgrade, and which…
9 min readSPIFFE/SPIRE Workload Identity: What a Compromised Node Actually Breaks
Unit 42 showed a root-compromised Kubernetes node can spoof SPIFFE/SPIRE workload identities via cgroup tricks. Here is what actually breaks,…
11 min read
Keycloak Authentication Error Handling: Custom Error Pages
Customize Keycloak error pages, handle OAuth/OIDC errors in your app, and configure brute force protection for secure, user-friendly authentication.
10 min read
Keycloak MFA: Configuration Patterns for Enterprise
How to set up Keycloak MFA: OTP policies, WebAuthn, conditional flows that apply MFA selectively, client-specific overrides, and detecting MFA…
18 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.