Project
Open-source identity and access management project providing single sign-on, user federation, and OAuth2/OpenID Connect support for apps and services.
GroundedDocs, a FastAPI RAG service, verifies Keycloak-signed tokens that expire in about 15 minutes and holds no key that can sign one. Keycloak now keeps the passwords and the signing key, so the identity provider becomes the system worth attacking.
Reality
CVE-2026-18963 lets an unauthenticated request skip the emailed reset token entirely. Upstream 26.7.2 and four Red Hat errata are out, and the stopgap has to be set realm by realm.
Perspective Coverage
4 publishersReality
CVE-2026-18963 sits in the Keycloak reset-credentials flow that Siemens embeds in Industrial Edge Management. Siemens closed its own Cloud service on September 2, and owners of self-hosted IEM Pro and IEM Virtual patch or block the path themselves.
Reality
IdentityServer4 stopped getting patches in 2022 and its repository is now read-only. The two replacement paths closest to its codebase both put the admin UI behind a separate licence, priced in different currencies.
Reality
A five-person team swapped eleven paid subscriptions for self-hosted open source and came out close to level, because the cost that mattered was the maintainer's own hours.
Reality
Written as separate entries, a country check and a model allowlist become alternatives, so a caller from a restricted jurisdiction gets through by naming an approved model, and the policy still reports Accepted and Attached.
Reality
Self-hosted Kubernetes still hands out certificate files that keep working after their owner leaves. The fix in a CNCF walkthrough turns on one Keycloak toggle, because a confidential client only moves the shared static credential onto every laptop.
Reality
The S256 pin is a per-client attribute, and the executor that builds a client from a published metadata document sets three attributes, all unrelated to PKCE. The executor addition imports cleanly, yet it never runs.
Reality
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Reality
A logic error in the uds-identity-config Keycloak authenticator compared the mounted Kubernetes secret against itself. Patched version numbers do not sort in the order operators expect.
Reality
One engineering write-up makes the case for modeling identity proof, session and consent as three separate transitions, with consent appended against an exact policy version.
Reality
CVE-2026-18963 lets an unauthenticated request skip the emailed token and reset any account on the server. Red Hat rates it 9.1. The stopgap costs you self-service recovery in every realm.
Reality
A dev.to walkthrough publishes the Keycloak stack behind an EKS gateway auth setup: one enabled grant, four redirect URLs, and a group membership Terraform does not fully own.
Reality
Dream Security recovered a 160-megabyte workspace from a framework built on open-source agents. Taiwan's Ministry of Digital Affairs has confirmed AI-assisted attacks on government systems in July.
Reality