A fully managed Keycloak solution with 99.95% SLA, ISO 27001 certification, 24/7 expert support — all hosted in Europe to ensure compliance and data sovereignty
Internet
Joined July 2019
- Tweets262
- Following28
- Followers219
- Likes73
A few critical vulnerabilities made the news last week. No action is needed for Cloud-IAM customers.
More details are available in our product updates: cloud-iam.com/changelog#7a8f…
We consider the risk of exploitation very low, as an attacker would need to be on the network path between your Keycloak and a service it calls. Deployments were automatically updated during their configured maintenance windows.
We want to give back to the tech community by sponsoring events where people can learn, share and have fun.
It started by the Keycloak DevDay 2026, and next it'll be with À la French Conférence and the Keycloak DevDay 2027.
You can find details on those events on our new sponsoring page => cloud-iam.com/sponsoring
Last Tuesday our team was at @IdentityDays 2026.
They particularly enjoyed the Keycloak and LemonLDAP::NG talk by the team at @worteks_com ! It was surprisingly musical, go watch the replay, you'll learn a lot about open IAM solutions and be entertained at the same time.
Just last week we witnessed multiple critical security issues: php2shell, eMudhra certificates compromised, Node.js Brotli decoder... The flood gates are open now, AI is accelerating the pace and it's not going to stop. Defenders need to step up or risk becoming an easy target.
A big thanks to @IdentityDays for the event. And if you missed us during the event, send us a message and we can arrange a chat!
We ship a lot and we didn’t talk about it much. So we shipped a changelog: features, fixes, security releases.
See it all here: eu1.hubs.ly/H0zhgHC0
We’re still figuring out what deserves a spot on it, so tell us what you’d want to see.
We're happy to announce that we are sponsor of the A la french conference on December 3rd in Paris!
The conference will be full of surprises and we're bringing some of ours too🛡️🛡️🛡️
Don't miss out and come see us there!
Keycloak 26.8.1 is out! It fixes 7 HIGH or CRITICAL CVEs that all come from Keycloak dependencies.
Details in the replies ⏬
The full list of fixes is on the official announcement: keycloak.org/2026/10/keycloa…, and the version will be available shortly on Cloud-IAM.
CVE-2025-66021 - 8.6 (OWASP Java HTML Sanitizer)
The sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows `noscript` and `style` tags with `allowTextIn` inside the style tag. This does not happen in Keycloak's own sanitizer policies but could happen in custom extensions.
You can find more information in the official migration guide: lnkd.in/eh6FMpBz and details about the other CVEs in the release post: lnkd.in/eTk-xaie.