[{"data":1,"prerenderedAt":215},["ShallowReactive",2],{"seo-verification":3,"blog-keycloak-cves-week-38-migrate-authelia-zitadel-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-keycloak-cves-week-38-migrate-authelia-zitadel-vps-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":152,"ctaBody":153,"ctaButton":154,"ctaUrl":155,"relatedPosts":156},372,"keycloak-cves-week-38-migrate-authelia-zitadel-vps",{"fr":12,"en":10,"ar":13,"es":14},"keycloak-cves-semaine-38-migrer-authelia-zitadel-vps","ثغرات-keycloak-الأسبوع-38-هجرة-إلى-authelia-zitadel","keycloak-cves-semana-38-migrar-authelia-zitadel-vps","Keycloak v26.7.4: 6 CVEs — migrate to Authelia or ZITADEL","Keycloak v26.7.4 patches 6 CVEs including two unauthenticated DoS. For fewer than 10 SSO apps on a VPS, Authelia (\u003C 30 MB) or ZITADEL cut the attack surface.",12,0,false,"2026-09-23T00:00:00+00:00","2026-09-23T15:23:17+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fkeycloak-cves-semaine-38-migrer-authelia-zitadel-vps-poster.svg",{"categorySlug":34,"appSlug":35},"cybersecurity-bastion","authelia","On September 16, 2026, the Keycloak team released version 26.7.4 with an unusual bulletin: six CVEs patched in one release, including two that let any anonymous actor on the internet crash your server without credentials. If you manage SSO for fewer than ten applications on a VPS, this signal is worth pausing on: is Keycloak still the right tool? This guide reviews all six vulnerabilities, compares lightweight alternatives Authelia and ZITADEL, and lays out a concrete migration path with Keycloak running in parallel.",[38,42,52,99,102,121,124,142,146,149],{"type":39,"title":40,"body":41},"h2","Keycloak v26.7.4 — why 6 CVEs in one week change the picture","The 26.7.4 release notes landed on September 16, 2026, one week after 26.7.3 had already closed several holes. This cadence reveals less an isolated bug than a structural debt in Keycloak's exposure surface: the project supports dozens of protocols (OIDC, SAML, LDAP, Kerberos), a full admin UI, and a server-side theme engine. Each layer carries its own network surface.\n\nThe two most severe vulnerabilities (CVE-2026-79651, CVSS 7.5, and CVE-2026-18212, CVSS 7.5) are particularly emblematic: they allow an unauthenticated attacker to exhaust the Keycloak process's memory by hitting publicly accessible endpoints — the login page and SAML endpoints — with no account required. On a VPS with 2–4 GB of RAM shared across several services, such a vector can take down the entire stack.\n\nAnother signal: version 26.7.1, released a few weeks earlier, had already introduced security regressions that 26.7.4 only partially fixes (CVE-2026-74909 is explicitly documented as an \"incomplete fix\" from 26.7.1). Two patch cycles in under a month on consecutive minor versions is a sign that the surface code is under pressure.",{"type":43,"title":44,"items":45},"ul","What each CVE could have allowed — plain-language summary",[46,47,48,49,50,51],"**CVE-2026-79651 (CVSS 7.5 — high)**: Keycloak accepts arbitrary locale tags on theme endpoints with no bounding or validation. An attacker loops unique locales from the public network; each request allocates memory that is never freed. Result: process crash via memory exhaustion, with zero user credentials required.","**CVE-2026-18212 (CVSS 7.5 — high)**: SAML Redirect DEFLATE helpers leak native zlib state. A malformed SAML request is enough to trigger memory corruption that can lead to a server crash or session data leak.","**CVE-2026-74909 (CVSS 8.1 — high)**: a percent-encoded semicolon (`%3B`) bypasses matrix-parameter stripping in PathMatcher. An attacker can reach a resource protected by a stricter policy by using the less-restrictive form of the same route.","**CVE-2026-90997 (CVSS 7.4 — high)**: on MySQL or MariaDB deployments, default row counts returned by the storage engine make anti-replay gates ineffective. A previously used authentication artifact can be reused.","**CVE-2026-17526 (CVSS 7.2 — high)**: the `impersonation` role can impersonate a realm administrator. An operator with limited permissions can elevate their privileges to full realm administration.","**CVE-2026-19607 (CVSS 5.3 — medium)**: a username collision in the identity federation (broker) flow locks the legitimate user out of their own account without any action on their part.",{"type":53,"title":54,"headers":55,"rows":60},"comparison","Keycloak vs Authelia vs ZITADEL — choosing for your VPS context",[56,57,58,59],"Criterion","Keycloak 26.7.4","Authelia 4.x","ZITADEL 2.x",[61,66,70,74,79,84,89,94],[62,63,64,65],"RAM at rest","512 MB – 1 GB (JVM)","\u003C 30 MB (Go)","150 – 300 MB (Go + CockroachDB or PostgreSQL)",[67,68,69,69],"Language \u002F runtime","Java (JVM)","Go — single binary",[71,72,72,73],"License","Apache 2.0","Apache 2.0 (core)",[75,76,77,78],"Protocols","OIDC, SAML, LDAP, Kerberos, WebAuthn","OIDC, 2FA (TOTP, WebAuthn)","OIDC, OAuth2, SAML, LDAP, WebAuthn",[80,81,82,83],"Admin interface","Full — realms, clients, flows","YAML only","Web console + gRPC\u002FREST API",[85,86,87,88],"Best for","> 20 apps, LDAP federation, enterprise SAML","\u003C 10 apps, proxy auth, technical team","\u003C 20 apps, dev team, API-first",[90,91,92,93],"VPS maintainability","Heavy: JVM, XML config, migrations","Light: 1 YAML file, 1 binary","Medium: database required, but clean API",[95,96,97,98],"CVE surface (history)","High: 6 CVEs in v26.7.4 alone","Low: \u003C 5 CVEs since 2022","Low to medium: younger project",{"type":39,"title":100,"body":101},"Authelia — lightweight SSO for fewer than 10 applications","Authelia is an authentication and authorization server written in Go. It exposes an HTTP validation endpoint that your reverse proxy (nginx, Traefik, Caddy) can query to protect applications without those applications needing to implement OIDC themselves. It also supports the full OIDC flow for applications that require it.\n\nIts memory footprint is its main operational strength: at idle, Authelia consumes between 20 and 30 MB of RAM according to measurements published in the project's GitHub issues (discussions #5939 and #6048). On a 2 GB VPS shared among Nextcloud, a mail server, and a reverse proxy, this is negligible — compared to Keycloak's 512 MB minimum before any load.\n\nConfiguration is entirely declarative (YAML). There is no graphical admin interface — an advantage for security (no exposable admin endpoint) and a drawback for non-technical teams. For a solo developer or a small team managing their own VPS applications, Authelia is often the right choice.",{"type":103,"title":104,"steps":105},"steps","Migrating from Keycloak to Authelia — OIDC export, config, tests",[106,109,112,115,118],{"title":107,"body":108},"Export your OIDC configuration from Keycloak","In the Keycloak admin console, go to Realm Settings → Export. Check \"Export clients\" and \"Export groups\". Download the resulting JSON — it contains your OIDC clients with their redirect URIs and scopes. This file serves as a reference for reconfiguring each application in Authelia; it is not imported directly.",{"title":110,"body":111},"Install Authelia with Docker Compose","Create a minimal `docker-compose.yml`:\n\n`services:`\n`  authelia:`\n`    image: authelia\u002Fauthelia:latest`\n`    volumes:`\n`      - .\u002Fconfig:\u002Fconfig`\n`    ports:`\n`      - 9091:9091`\n`    restart: unless-stopped`\n\nCreate the `config\u002F` directory and place `configuration.yml` inside it. The official documentation provides a complete skeleton at `https:\u002F\u002Fwww.authelia.com\u002Fconfiguration\u002Fprologue\u002Fintroduction\u002F`.",{"title":113,"body":114},"Configure OIDC clients in Authelia","For each application migrated from Keycloak, add an entry under `identity_providers.oidc.clients` in `configuration.yml`:\n\n`identity_providers:`\n`  oidc:`\n`    clients:`\n`      - id: my-app`\n`        secret: '$pbkdf2-sha512$...'`\n`        redirect_uris:`\n`          - https:\u002F\u002Fmy-app.example.com\u002Foauth\u002Fcallback`\n`        scopes: [openid, email, profile]`\n\nGenerate the secret with `authelia crypto hash generate pbkdf2 --variant sha512`. Use the Keycloak export JSON to find each client's redirect URIs.",{"title":116,"body":117},"Configure your reverse proxy to query Authelia","Authelia works as a validation middleware. In nginx, add an `auth_request` block:\n\n`location \u002Fauthelia {`\n`  internal;`\n`  proxy_pass http:\u002F\u002Fauthelia:9091\u002Fapi\u002Fauthz\u002Fforward-auth;`\n`  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`\n`}`\n\n`location \u002F {`\n`  auth_request \u002Fauthelia;`\n`  proxy_pass http:\u002F\u002Fmy-app:3000;`\n`}`\n\nFor applications that use OIDC natively, point the issuer to `https:\u002F\u002Fauth.your-domain.com`.",{"title":119,"body":120},"Test each application before cutting over from Keycloak","For each migrated application, verify three flows: initial login (redirect to Authelia → authentication → return to app), logout (Authelia cookie and app session invalidated), and second factor if enabled (TOTP or WebAuthn). Only cut over from Keycloak once all flows for all applications are validated on Authelia. Keep the Keycloak container stopped but not deleted for 30 days to allow rollback.",{"type":39,"title":122,"body":123},"ZITADEL — API-first identity provider for development teams","ZITADEL is an Identity Provider written in Go, licensed under Apache 2.0, published by the Swiss team ZITADEL Cloud. Its official repository is `github.com\u002Fzitadel\u002Fzitadel`. Where Authelia is designed as a proxy middleware, ZITADEL is a full-featured IdP with a first-class gRPC\u002FREST API — built for organizations that build applications, not just protect them.\n\nThe memory footprint is higher than Authelia because ZITADEL requires a database (PostgreSQL or CockroachDB), but stays in the 150–300 MB range under normal load — well below Keycloak's 512 MB JVM minimum. The project supports OIDC, OAuth2, SAML 2.0, read-only LDAP, and WebAuthn.\n\nZITADEL is particularly suited to development teams building SaaS applications who need to manage organizations and users programmatically via API, without going through a GUI for every operation. The web console is available but the API is the primary path.",{"type":103,"title":125,"steps":126},"Migrating from Keycloak to ZITADEL — procedure on VPS",[127,130,133,136,139],{"title":128,"body":129},"Deploy ZITADEL with Docker Compose","ZITADEL provides an official `docker-compose.yml` in its GitHub repository (the `e2e\u002F` directory). The minimal configuration requires PostgreSQL (or CockroachDB) and a 32-character `ZITADEL_MASTERKEY`:\n\n`ZITADEL_MASTERKEY=$(openssl rand -base64 32)`\n\nConsult the official documentation at `https:\u002F\u002Fzitadel.com\u002Fdocs\u002Fself-hosting\u002Fdeploy\u002Fcompose` for the complete file and required environment variables.",{"title":131,"body":132},"Create OIDC applications in ZITADEL","In the ZITADEL console (`https:\u002F\u002Fyour-instance:8080`), create an Organization, then a Project. Inside that project, create an Application of type \"Web\" or \"User Agent\" depending on your use case.\n\nZITADEL generates a Client ID and Client Secret. Configure the Redirect URIs using your Keycloak export JSON as reference. The Discovery endpoint is at `https:\u002F\u002Fyour-instance:8080\u002F.well-known\u002Fopenid-configuration`.",{"title":134,"body":135},"Migrate users from Keycloak","Keycloak can export users from a realm as JSON via the console (Realm Settings → Export → check \"Export users\"). Hashed passwords cannot be imported directly into ZITADEL — the hashing algorithms differ.\n\nTwo approaches: (1) import user metadata via the ZITADEL API (`POST \u002Fmanagement\u002Fv1\u002Fusers\u002Fhuman\u002F_import`) with forced password reset on first login, or (2) progressive migration via social\u002FOIDC login (ZITADEL consumes Keycloak as an external IdP during the transition). Approach (2) avoids asking all users to reset their passwords on the same day.",{"title":137,"body":138},"Update your applications to point to ZITADEL","Update environment variables for each application:\n\n`OIDC_ISSUER=https:\u002F\u002Fyour-instance:8080`\n`OIDC_CLIENT_ID=\u003Czitadel-client-id>`\n`OIDC_CLIENT_SECRET=\u003Czitadel-client-secret>`\n\nThe Discovery endpoint allows most OIDC libraries to self-configure. Test each application with a test account before switching production traffic.",{"title":140,"body":141},"Validate SSO flows and disable Keycloak","Verify login, logout, token refresh, and second factor on each application. In ZITADEL, the \"Sessions\" tab in the console lets you see active sessions in real time and invalidate them if needed.\n\nKeep the Keycloak container stopped but not deleted for 30 days. Delete it after this retention period.",{"type":143,"title":144,"body":145},"tip","Keeping Keycloak running in parallel — the clean cutover strategy","The classic objection to migrating an IdP is valid: all your applications share the same identity provider. If the migration fails halfway through, no one can log in.\n\nThe recommended strategy is to keep Keycloak operational throughout the migration and cut over applications one at a time. Several mechanisms make this straightforward:\n\n**Per-application DNS**: each application points to an IdP via an environment variable. Change `OIDC_ISSUER` for one application at a time, test, then move to the next. Keycloak continues serving applications not yet migrated.\n\n**Independent sessions**: OIDC creates independent application sessions. An application migrated to Authelia or ZITADEL does not invalidate active sessions for applications still on Keycloak.\n\n**30-day window**: most migrations of fewer than 10 applications take 2 to 5 days of technical work. Plan for a week, validate for 30 days, then cut over. The `docker compose stop keycloak` command is reversible in 30 seconds.",{"type":39,"title":147,"body":148},"Common mistakes during SSO migration","Four pitfalls recur consistently in Keycloak-to-lightweight migrations.\n\n**Forgotten redirect URIs**: Keycloak validates redirect URIs exactly by default. Authelia and ZITADEL do the same. If your application sends `https:\u002F\u002Fapp.example.com\u002Fcallback` but the IdP configuration declares `https:\u002F\u002Fapp.example.com\u002Foauth\u002Fcallback`, authentication fails with a `redirect_uri_mismatch` error. Check each URI in the Keycloak export JSON.\n\n**Scopes and claims are not identical**: Keycloak can be configured to return custom claims (roles, user attributes) that your applications consume. Authelia returns only `openid`, `profile`, and `email` by default. If your application depends on a `roles` or `groups` claim, verify that your target IdP can produce it before cutting over from Keycloak.\n\n**IdP session and application session are distinct**: a logout from the IdP does not automatically log out the application if it does not implement back-channel logout. Users may remain logged in to an application after being logged out of the IdP. Test the full logout flow explicitly.\n\n**Clock skew invalidates tokens**: OIDC tokens have a short validity window (typically 5 to 15 minutes). If your VPS clock drifts by more than a few dozen seconds, tokens expire before they are used. Verify that `chrony` or `systemd-timesyncd` is active on your VPS with `timedatectl status`.",{"type":39,"title":150,"body":151},"After migration — testing authentication for each application","An SSO migration is not complete when the first login works. Here is the minimum validation checklist to apply to each application.\n\n**Initial login**: open a private browsing session (no existing cookies) and log in. The redirect to the IdP must work, authentication must succeed, and the return to the application must land on the correct page.\n\n**Refresh token**: wait for the access token to expire (or force it in a dev environment) and verify that the application silently refreshes the token without forcing a re-login.\n\n**Logout**: log out from the application and verify that the session is invalidated on the IdP side (Authelia: `authelia_session` cookie absent; ZITADEL: session absent from the console). Attempt to access a protected resource after logout — you should be redirected to the login page.\n\n**Second factor**: if 2FA is enabled, test TOTP and WebAuthn separately. WebAuthn sessions are domain-bound — a simultaneous domain migration would invalidate all existing passkeys.\n\n**Unauthorized access**: attempt to access a protected resource without a valid token and verify that the response is a 401 or a redirect to the IdP, not a 500 or an application page without data.","Authelia or ZITADEL deployed on your VPS in minutes","ServOrbit offers Authelia as a marketplace application. Deploy lightweight SSO on your VPS without manual Docker Compose configuration.","Deploy Authelia on VPS","\u002Fmarketplace\u002Fsecurite\u002Fauthelia",[157,176,192],{"id":158,"slug":159,"slugs":160,"title":164,"excerpt":165,"readTime":166,"views":167,"isPinned":19,"publishedAt":168,"updatedAt":169,"category":170,"categories":171,"featuredImage":30,"bgImage":31,"posterImage":173,"relatedSolution":174},272,"authentik-authelia-or-keycloak-choosing-your-sso-on-vps",{"fr":161,"en":159,"ar":162,"es":163},"authentik-vs-authelia-keycloak-sso-vps-2026","authentik-أو-authelia-أو-keycloak-اختيار-sso-على-vps","authentik-authelia-o-keycloak-elegir-sso-en-vps","Authentik, Authelia or Keycloak: Choosing Your SSO on VPS","Authentik, Authelia or Keycloak on VPS: compare real memory footprint, covered protocols and Keycloak 26.7.1 CVEs to choose the right self-hosted SSO.",6,1,"2026-08-16T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[172],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fauthentik-vs-authelia-keycloak-sso-vps-2026-poster.svg",{"categorySlug":34,"appSlug":175},"authentik",{"id":177,"slug":178,"slugs":179,"title":183,"excerpt":184,"readTime":166,"views":185,"isPinned":19,"publishedAt":186,"updatedAt":169,"category":187,"categories":188,"featuredImage":30,"bgImage":31,"posterImage":190,"relatedSolution":191},162,"self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack",{"fr":180,"en":178,"ar":181,"es":182},"self-host-authelia-vps","استضافة-authelia-على-vps-مصادقة-ثنائية-ودخول-موحد-لمنظومتك","alojar-authelia-en-un-vps","Self-Host Authelia on a VPS: MFA and SSO for Your Whole Stack","Deploy Authelia on your VPS to add MFA, SSO and fine-grained access control in front of any self-hosted app — no code changes, one configuration file.",2,"2026-07-04T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[189],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fself-host-authelia-vps-poster.svg",{"categorySlug":27,"appSlug":35},{"id":193,"slug":194,"slugs":195,"title":199,"excerpt":200,"readTime":201,"views":18,"isPinned":19,"publishedAt":202,"updatedAt":203,"category":204,"categories":210,"featuredImage":30,"bgImage":31,"posterImage":212,"relatedSolution":213},351,"self-host-zitadel-vps-open-source-iam-developers",{"fr":196,"en":194,"ar":197,"es":198},"deployer-zitadel-vps","zitadel-vps-iam-maftouh-almassdar-lilmutatawireen","instalar-zitadel-vps-iam-codigo-abierto-desarrolladores","Self-Host ZITADEL on a VPS: Open-Source IAM for Developers","Deploy ZITADEL self-hosted on a VPS: OIDC, OAuth 2.0, passkeys and native multi-tenancy with Docker Compose in under 5 minutes.",3,"2026-01-08T00:00:00+00:00","2026-09-16T14:44:13+00:00",{"id":205,"name":206,"slug":207,"color":208,"icon":209},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[211],{"id":205,"name":206,"slug":207,"color":208,"icon":209},"\u002Fblog\u002Fcovers\u002Fdeployer-zitadel-vps-poster.svg",{"categorySlug":27,"appSlug":214},"zitadel",1790177319816]