Topic
Keycloak
Securing AI Agents with Database Access Using Token Exchange, DPoP and Row-Level Security
AI Security
RWB Deploys Enterprise-Wide Database Access Control with Trino and Open Policy Agent
Policy & Regulation
Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
Vulnerabilities & ExploitsAlfa-Bank Balances Cloud Trust and Zero Trust Models During Migration to Yandex Cloud
Alfa-Bank's head of container and cloud security, Sasha Chertok, detailed how the bank migrated regulated workloads to Yandex Cloud while preserving existing Zero Trust controls. The organization mapped on-premises network segmentation, Active Directory authentication, and firewall policies directly onto Yandex Cloud resources using interconnect links secured with GOST encryption. Responsibility for managed services is shared under a Cloud Trust model, yet the bank retains oversight through Terraform-managed Security Groups, custom CSPM checks, and internal CI/CD gates. User access continues to authenticate via on-premises Active Directory and KeyCloak federations, while authorization leverages granular Yandex Cloud IAM roles. Logging and detection rely on a combination of Yandex Cloud Audit Trail, Cloud Logging, and the YCDR service to compensate for incomplete control-plane visibility. The resulting hybrid architecture now supports 1,500 virtual machines, 100 managed services, and 1,000 identities across multiple environments without disrupting established security processes.
redb.Identity Deploys Three-Layer Defense to Neutralize Stolen Access Tokens in OpenID Connect
redb.Identity, a custom OAuth 2.1 and OpenID Connect provider built on .NET, addresses the inherent risks of bearer access tokens by implementing three distinct protection layers. The first layer uses a Backend-for-Frontend pattern with Blazor Server and HttpOnly cookies to ensure no tokens ever reach the browser. The second layer applies DPoP proof-of-possession binding so that a stolen token remains useless without the corresponding private key. The third layer provides rapid revocation through RFC 7009 endpoints, refresh token rotation, idle timeouts, and a hybrid push-pull backchannel logout mechanism that guarantees no revocation is lost across replicas. The architecture also mitigates XSS vectors from direct application code, compromised npm dependencies, browser extensions, and localStorage. Additional routine controls include constant-time secret comparison, TOTP replay protection, rate limiting at multiple scopes, and sanitized proxy headers. The design explicitly acknowledges that BFF shifts rather than eliminates risk, requiring complementary CSRF protection via SameSite cookies and antiforgery tokens.
Keycloak Fixes Critical CVE-2026-18963 Password Reset Flaw Allowing Unauthenticated Account Takeover
Keycloak has patched a critical vulnerability tracked as CVE-2026-18963 that lets remote unauthenticated attackers force a password reset for any user and seize control of the account. The flaw affects the reset-credentials flow due to improper state validation, enabling attackers to bypass email verification and reach the password change endpoint directly. With a CVSS 3.1 score of 9.1, the issue requires no privileges or user interaction and impacts confidentiality and integrity. Patches are available in Keycloak 26.7.2 and corresponding Red Hat Build of Keycloak releases 26.4.15 and 26.6.6. Organizations unable to update immediately should disable the Forgot password feature across all realms. Post-remediation auditing of login events and credential changes on privileged accounts is recommended to detect any prior exploitation attempts.
Building a Minimal Open Source Security Stack for Infrastructure Protection
The article outlines a practical approach to assembling a basic cybersecurity stack using open source tools for organizations with limited budgets. It covers endpoint protection with ClamAV, network perimeter defense via pfSense including Snort and Suricata integration, centralized logging with ELK Stack or Wazuh, and identity management through Keycloak. The guide emphasizes that these solutions provide foundational capabilities but require careful configuration, regular updates, and community validation to avoid risks from unmaintained projects. Detailed installation steps, rule configuration examples, and integration advice are provided for each component. The author stresses that open source options serve as an entry point rather than a full replacement for commercial platforms like Kaspersky or Symantec.
Step-Up Authentication vs 2FA: Implementing Additional Verification for Sensitive Operations in Corporate Systems
Traditional two-factor authentication secures only the initial login, leaving active sessions vulnerable to misuse during sensitive tasks such as accessing payroll data. Step-Up Authentication addresses this by requiring extra verification at the moment of critical actions rather than at login. The article details how one project moved beyond standard Identity Provider features in WSO2 by building a dedicated PIN-code service and gateway-2fa microservice. This approach uses signed cookies with TTL controls and JWT cross-checks to enforce elevated trust levels without disrupting normal user flows. The solution aligns with Zero Trust principles and was monitored via Matomo and ELK for usage and performance metrics. Key implementation considerations include balancing TTL duration, encrypting stored PINs, and conducting load testing before deployment.