Three items, one tier: Keycloak's reset bug, an N-able password leak, a Grok data-theft trick

Every password reset flow is a second authentication path, usually with one factor holding it up. In Keycloak that factor was the emailed token, and with the token not properly validated the path would accept anonymous requests to change any user's password ^[2]. No other part of the stack was asked to agree.

Then there is distribution. Keycloak is rarely a purchase decision; it is the identity and access management layer sitting under other products and web applications, with Red Hat using it heavily and supporting its development ^[7]. Upstream exists as 26.7.2, with a number of security fixes in it ^[1], but an operator running Keycloak inside somebody else's appliance gets those fixes on the vendor's rebuild schedule ^[10].

Discovery was not systematic either. Johannes Ullrich credited a listener named Daniel for pointing the issue out, and said he would probably have missed it otherwise ^[8]. Release notes for embedded identity components are read by very few people, and that is the channel this one travelled down.

The other two items in the same episode are, in the material available, links with headlines attached. Ronnie Utevsky's post at adversa.ai describes what he calls cryptographic context injection, presented as a way around safeguards in large language models and framed in both the episode title and the link itself as data theft against Grok ^[3]. The transcript stops mid-sentence before the method is explained ^[13], so it is a pointer rather than a finding. The N-able entry is filed as a password manager leak and points at a post whose own URL calls it SolarWinds part two ^[4].

The Microsoft Graph diaries alongside them are hygiene work: two PowerShell scripts from Rob, one listing users with stale accounts and the licenses assigned to them, the other collecting Entra risk detections with the reason each was raised, including unusual browser user agents and origin by geography or ASN ^[5]. Stale accounts belong to the same tier as the Keycloak bug. A dormant account still has a reset flow wired to a mailbox nobody reads, and it still holds whatever roles it was handed.

Four topics in one episode, three of them about the machinery that holds credentials ^[12]. Token validation is the entire Keycloak fix, which is the least interesting class of finding and the one that reaches furthest.