alt3kx/cve-2026-18963أداة كشف وتحقق لـ CVE-2026-18963، وهي ثغرة تجاوز حالة إعادة تعيين بيانات الاعتماد في Keycloak. تقوم ببصمة الإصدار، وتعداد النطاقات (realms) والعملاء (clients) والمستخدمين، وتختبر ما إذا كان شرط رمز الإجراء (action-token) مُطبَّقًا، وذلك للتقييمات المصرح بها.
https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e
python3 kc-resetforge.py -h
usage: kc-resetforge.py [-h] [--target TARGET] [--targets-file TARGETS_FILE] [--port PORT] [--realm REALM]
[--client-id CLIENT_ID] [--username USERNAME] [--new-password NEW_PASSWORD] [--skip-enum]
[--enum-only] [--kc-version] [--kc-reset-link] [--corpus-dir CORPUS_DIR] [--label LABEL]
[--enum-realms] [--no-enum-realms] [--enum-clients] [--no-enum-clients] [--enum-users]
[--no-enum-users] [--realm-wordlist REALM_WORDLIST] [--client-wordlist CLIENT_WORDLIST]
[--user-wordlist USER_WORDLIST] [--enum-users-client-id ENUM_USERS_CLIENT_ID]
[--verify-login] [--no-verify-login] [--verify-client-id VERIFY_CLIENT_ID]
[--timeout TIMEOUT] [--request-delay REQUEST_DELAY] [--output-dir OUTPUT_DIR]
[--proxy PROXY] [-d] [-y] [--json-out JSON_OUT]
CVE-2026-18963 Keycloak recon + exploit framework (own infra only)
options:
-h, --help show this help message and exit
--target TARGET Single target: bare host/IP, host:port, or a full http(s)://host[:port] URL. Scheme and port
are auto-detected if omitted (tries https then http; defaults to 443/80 respectively).
Mutually exclusive with --targets-file.
--targets-file TARGETS_FILE
Path to a file with one target per line, same flexible formats as --target ('#' comments
allowed). Runs recon+exploit against every target in turn.
--port PORT Override port for --target (or a fallback for --targets-file lines without their own port).
Per-line ports in --targets-file always take precedence.
--realm REALM Realm to target. If omitted, auto-selected from recon results.
--client-id CLIENT_ID
OIDC client_id to use. If omitted, auto-selected from recon results.
--username USERNAME Username to target. If omitted, auto-selected from recon results.
--new-password NEW_PASSWORD
Password to set for the target user (default: 'Test123!')
--skip-enum Skip recon entirely; --realm/--client-id/--username become required.
--enum-only Run recon and print results, but do not attempt exploitation.
--kc-version Only run the Keycloak version recon phase (fingerprint + corpus match + patch status) and
exit - skips realm/client/user enumeration and exploitation entirely. Works with both
--target and --targets-file.
--kc-reset-link Only check whether the self-service password-reset ('Forgot Password?' /
resetPasswordAllowed) flow is exposed, then exit - a single non-destructive GET, no username
needed. Auto-discovers realm/client via a light realm+client recon unless --realm/--client-
id are given explicitly. Skips exploitation. Works with both --target and --targets-file.
--corpus-dir CORPUS_DIR
Directory of known-version fingerprints for exact version matching (default:
kc_version_corpus).
--label LABEL Save THIS target's fingerprint into the corpus under this version label instead of matching
an unknown version. Use on an instance of known version.
--enum-realms Enumerate realm names (default: on during recon).
--no-enum-realms
--enum-clients Enumerate client IDs per realm (default: on during recon).
--no-enum-clients
--enum-users Enumerate usernames per realm (default: on during recon).
--no-enum-users
--realm-wordlist REALM_WORDLIST
--client-wordlist CLIENT_WORDLIST
--user-wordlist USER_WORDLIST
--enum-users-client-id ENUM_USERS_CLIENT_ID
Client used for the username-enumeration direct-grant probe (default: admin-cli).
--verify-login After a password change, confirm the new credentials via a password-grant token request
(default: on).
--no-verify-login
--verify-client-id VERIFY_CLIENT_ID
Client used for the verification password grant.
--timeout TIMEOUT
--request-delay REQUEST_DELAY
Seconds to wait before each request in the exploit chain (default: 0.4). Keycloak's login-
flow state can be timing-sensitive across the reset/restart/selector replay steps; a small
delay makes the chain more reliable. 0 to disable.
--output-dir OUTPUT_DIR
--proxy PROXY Route through an HTTP(S) proxy: 'burp' (127.0.0.1:8080 shorthand), a bare host:port, or a
full http(s):// URL.
-d, --debug Verbose debug logging of requests/responses/enum probes
-y, --yes Skip the 'Continue with this target?' prompt. Required for non-interactive use (scripts,
--targets-file with multiple targets, CI).
--json-out JSON_OUT Write a JSON report of recon + exploit results to this path.
kc-resetforge — CVE-2026-18963 Keycloak recon + exploit tool (own infra only)
Usage
-----
Fully automatic (recon -> auto-pick target -> exploit -> verify):
python3 kc-resetforge.py --target https://localhost:9990 --proxy burp -d
Recon only:
python3 kc-resetforge.py --target https://localhost:9990 --enum-only -d
Version + patch-status check only, across many hosts:
python3 kc-resetforge.py --targets-file targets.txt --kc-version
Skip recon, target directly:
python3 kc-resetforge.py --target https://localhost:9990 --realm master \
--client-id account --username admin --skip-enum
Requires: requests, beautifulsoup4, and optionally rich (pip install --break-system-packages)
| الحقل | القيمة |
|---|---|
| CVE | CVE-2026-18963 |
| الخطورة | حرجة |
| CVSS | 9.1 |
| CWE | CWE-640 (آلية استرداد كلمة مرور ضعيفة) |
| المكوّن | Keycloak — تدفق مصادقة إعادة تعيين بيانات الاعتماد |
| التأثير | استيلاء على الحساب دون مصادقة ودون أي تفاعل (بما في ذلك حسابات المسؤولين) |
| الإصدار المُصلَّح | Keycloak 26.7.2 (المنبع) / RHBK 26.4.15-1، 26.6.6-1 |
26.7.226.4.15-1 / الصور 26.4-2326.6.6-1 / الصور 26.6-12kc-resetforge هي أداة كشف/تحقق. تؤكد ما إذا كان تدفق إعادة تعيين بيانات الاعتماد في الهدف يفرض شرط رمز الإجراء المسبق بشكل صحيح (مُرقَّع) أم لا (قابل للاستغلال)، لاستخدامها في التقييمات المصرح بها. يغطي التحليل المرتبط أدناه الآلية ومنهجية إعادة الإنتاج بالعمق المناسب للكشف العام.
التحليل الكامل: Forging kc-resetforge: Turning CVE-2026-18963 Into a Repeatable Check