Update your Keycloak
For community, version 26.7.2 has the fix:
https://www.keycloak.org/2026/08/keycloak-2672-released
This one is bad - unauthenticated user account take over.
If you’re like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy
Out of curiosity, what is the advantage of using something like this on LAN only?
for many people homelabbing is a way to gain knowledge they can use on the job.
other than that: proper single sign on across your services is nice even if you don’t expose them to anybody else.
It will still sync to all devices. And if you have an always on vpn to your home network, there really is no need to expose it to the public
For me, I have multiple OIDC compatible systems (Proxmox, Netbox, Synology, Zabbix, Vault, etc).
So keycloak offers a SSO option to make my life easier with a single account to worry about instead of individual ones.
Plus MFA because it’s cool?
