Keycloak 26.7.1 Bug: OAuth Metadata-Provisioned Clients Skip PKCE and Scope Inheritance

·1 views

A security gap in Keycloak 26.7.1 causes clients auto-provisioned via the OAuth Client ID Metadata Document (CIMD) feature to bypass PKCE enforcement, accepting both plain challenges and requests with no code_challenge at all. The provisioned clients also lack basic scopes, audience mappers, and realm capability scopes because the CIMD executor only sets three attributes — consent-related ones — with no PKCE configuration included. The root cause is an inheritance gap: hand-authored clients carry PKCE settings in their own JSON, but auto-provisioned clients only receive what the executor explicitly assigns. Keycloak's Server Administration Guide does warn that client policy conditions may not always evaluate as expected and advises testing, but the separate MCP setup guide that enables this feature contains no such warning. The fix is straightforward — adding Keycloak's built-in pkce-enforcer executor to the existing client profile ensures provisioned clients are also pinned to S256.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer finds 3 security flaws in own AI agent app using Google Antigravity

A developer building GeoMart, an AI-powered survey equipment storefront, for OpenAI's WebMCP Challenge discovered three security vulnerabilities after asking Google Antigravity to audit the full source code. The tool identified an unescaped innerHTML injection flaw and an unprotected API endpoint that allowed quote submissions without any human involvement. An initial fix using an Origin header check proved insufficient, as a Node.js script could simply spoof the header since the expected value was visible in the open-source repository. A more robust solution was implemented using Cloudflare Turnstile, verified server-side against a secret never stored in the codebase, which successfully blocked all replay attacks. The audit also uncovered an unrelated but critical bug: a database migration for storing submitted quotes had never been run, meaning the core human-approval feature had been silently broken throughout development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Chat Tools Quietly Replaced Google and Stack Overflow for Developers

Over roughly six years, developers' go-to resource for debugging shifted from Google searches and Stack Overflow threads to AI chat tools like ChatGPT. The author traces the turning point to late 2022, when ChatGPT began answering error messages with context-aware precision, making traditional search feel redundant. Stack Overflow's monthly question volume reportedly fell from over 200,000 to under 50,000 by late 2025, the lowest figure since the platform's early days in 2009. While AI tools offer faster answers, the author argues that the slow, frustrating process of sifting through wrong answers was itself a key learning mechanism. A broader concern is also raised: bugs solved in private AI chat windows leave no public record, quietly eroding the shared knowledge base that the developer community once built together.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer rewrites 14 web scrapers after AI agent silently returned wrong results

A developer discovered that connecting his 14 Apify web-scraping Actors to Claude via the Model Context Protocol (MCP) exposed a critical design flaw in late July 2025. While the scrapers worked perfectly when operated manually, AI agents calling them would receive empty datasets or silently incorrect results because the input schemas assumed human context, such as having the target website open nearby. Unlike human users who can troubleshoot and retry, an AI agent has a single shot to interpret inputs, execute a run, and branch on the output, meaning ambiguous results led it confidently down the wrong path. The most costly example involved a software registry Actor that required an internal opaque integer ID only obtainable by inspecting the site's markup, causing agents passing readable class codes to get clean but empty — or worse, plausibly wrong — results. The developer subsequently refactored all 14 Actors to resolve site-specific lookups internally in code, ensuring any caller without prior site knowledge could still produce correct, distinguishable outcomes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Knowing What Credentials Were on a Compromised Laptop Is So Hard

When a developer's laptop is stolen or compromised, security teams must quickly determine which credentials were exposed — a process experts call answering the 'blast radius question.' Most organizations lack a pre-incident credential inventory, forcing responders to reconstruct exposed secrets manually under time pressure or rotate everything indiscriminately. Credentials are scattered across .env files, shell histories, CLI caches, SSH keys, and AI tool caches, making comprehensive discovery difficult. GitGuardian's 2026 report found 28.6 million new secrets leaked on public GitHub in 2025 alone, a 34% year-over-year increase, underscoring the scale of the problem. Security experts argue that maintaining a per-machine credential inventory before an incident occurs is the key to faster, more precise response and a smaller blast radius.

0 comments Read more at DEV Community