exu@feditown.com to Selfhosted@lemmy.worldEnglish · 3 months agoCritical Keycloak Vulnerability (CVSS 9.1) - CVE-2026-18963access.redhat.comexternal-linkmessage-square5linkfedilinkarrow-up10arrow-down10file-text
arrow-up10arrow-down1external-linkCritical Keycloak Vulnerability (CVSS 9.1) - CVE-2026-18963access.redhat.comexu@feditown.com to Selfhosted@lemmy.worldEnglish · 3 months agomessage-square5linkfedilinkfile-text
Update your Keycloak For community, version 26.7.2 has the fix: https://www.keycloak.org/2026/08/keycloak-2672-released
minus-squareplateee@piefed.sociallinkfedilinkEnglisharrow-up0·3 months agoThis one is bad - unauthenticated user account take over. If you’re like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy
minus-squareiamthetot@piefed.calinkfedilinkEnglisharrow-up0·3 months agoOut of curiosity, what is the advantage of using something like this on LAN only?
minus-squareDunstabzugshaubitze@feddit.orglinkfedilinkEnglisharrow-up1·3 months agofor many people homelabbing is a way to gain knowledge they can use on the job. other than that: proper single sign on across your services is nice even if you don’t expose them to anybody else.
minus-squareB0rax@feddit.orglinkfedilinkEnglisharrow-up1·3 months agoIt will still sync to all devices. And if you have an always on vpn to your home network, there really is no need to expose it to the public
minus-squareplateee@piefed.sociallinkfedilinkEnglisharrow-up0·3 months agoFor me, I have multiple OIDC compatible systems (Proxmox, Netbox, Synology, Zabbix, Vault, etc). So keycloak offers a SSO option to make my life easier with a single account to worry about instead of individual ones. Plus MFA because it’s cool?
This one is bad - unauthenticated user account take over.
If you’re like me and only using it internally on a homelab, the risks are lessened, but if you expose keycloak to by the Internet - boy howdy
Out of curiosity, what is the advantage of using something like this on LAN only?
for many people homelabbing is a way to gain knowledge they can use on the job.
other than that: proper single sign on across your services is nice even if you don’t expose them to anybody else.
It will still sync to all devices. And if you have an always on vpn to your home network, there really is no need to expose it to the public
For me, I have multiple OIDC compatible systems (Proxmox, Netbox, Synology, Zabbix, Vault, etc).
So keycloak offers a SSO option to make my life easier with a single account to worry about instead of individual ones.
Plus MFA because it’s cool?