#Keycloak
All CosmicBytez Labs articles tagged #Keycloak, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-123047: Eclipse BaSyx Helm Chart Stores Keycloak Passwords in Cleartext ConfigMap
Eclipse BaSyx Helm charts 3.0.0-rc.1 to 3.12.1 write bundled Keycloak user passwords in cleartext to a Kubernetes ConfigMap. CVSS 7.5.
- Security
CVE-2026-111882: phpMyFAQ SSO Callback Lets Attackers Skip TOTP 2FA
A phpMyFAQ auth bypass lets anyone with a valid IdP identity skip TOTP via Keycloak or Entra ID SSO callbacks, landing an authenticated session.
- Newsletter
Weekly Digest — Issue #32
Oracle WebLogic and Keycloak both land on active-exploitation radar, a critical isolated-vm sandbox escape threatens AI agent stacks, and the US sanctions...
- News
Critical Keycloak Flaw Lets Attackers Reset Any Account Password Without Authentication
CVE-2026-18963 (CVSS 9.1) in Keycloak allows unauthenticated attackers to bypass email verification and take over any account. Patch to 26.7.2 immediately.
- Project
Keycloak SSO: Self-Hosted Identity Provider for Your Homelab
Deploy Keycloak with Docker Compose and PostgreSQL to build a centralised single sign-on platform for your homelab services, with OIDC integration for...