CVE-2026-60206 – Oracle WebLogic Server SAML Authentication Bypass PoC

This repository provides a proof‑of‑concept exploit for CVE‑2026‑60206, a critical authentication bypass vulnerability in the SAML implementation of Oracle WebLogic Server. The flaw allows a remote, low‑privileged attacker to completely compromise the server by forging SAML assertions.

⚠️ Disclaimer: This tool is intended for authorized security research and testing only. Use it only against systems you own or have explicit permission to test. The authors assume no liability for misuse.

🔥 Vulnerability Overview

CVE-2026-60206 affects the Core component of Oracle WebLogic Server. The vulnerability stems from improper authentication handling in the SAML protocol implementation. Multiple attack vectors—such as XML Signature Wrapping (XSW), unsigned assertion acceptance, NameID manipulation, and audience/conditions bypass—allow an attacker to impersonate arbitrary users (e.g., weblogic) and gain administrative access.

Affected Versions:

• 12.2.1.4.0
• 14.1.1.0.0
• 14.1.2.0.0
• 15.1.1.0.0

The PoC implements the following attack vectors:

• XML Signature Wrapping (XSW) – structural manipulation to make the SAML processor accept an unsigned assertion.
• Unsigned Assertion Injection – craft a completely unsigned SAML response (if WantAssertionsSigned is not enforced).
• NameID Manipulation – confuse the identity mapper via XML comments, whitespace, or format confusion.
• Audience Restriction Bypass – remove or modify AudienceRestriction to broaden scope.
• Conditions/Time Bypass – manipulate NotBefore/NotOnOrAfter to bypass validity checks.
• Combined Attack – XSW + unsigned inner assertion + NameID manipulation (most likely to succeed).
• Replay – replay a captured SAML response with modified destination/recipient.

✨ Features

• Multiple attack modes – select from all, unsigned, xsw, nameid, audience, conditions, combo, or replay.
• Mass scanning – concurrent detection and optional exploitation across many targets (via -l).
• Version detection – accurately fingerprint WebLogic version via headers, error pages, and WSDL.
• SAML endpoint probing – automatically discover SAML ACS, metadata, and SP‑initiated endpoints.
• Tor support – route traffic through Tor (SOCKS5/HTTP/SOCKS4) for anonymity.
• Raw HTTP request replay – send arbitrary raw HTTP requests from a file (-r).
• HTTP/2 support – automatically uses httpx if installed, falls back to requests (HTTP/1.1).
• User‑Agent rotation – use a random or custom User‑Agent.
• Proxy support – send all requests through an HTTP/SOCKS proxy.
• Request customisation – set timeouts, retries, delays, disable redirects, and retry on regex pattern.
• Payload saving – save generated SAML payloads to disk (--save-payloads).
• Vulnerability check (-c / --check) – quickly determine if a target is vulnerable (non‑exploit).
• JSON/CSV report output – structured results for mass scans.
• Verbose logging – detailed debug output with coloured console.

📦 Installation

git clone https://github.com/Debajyoti0-0/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt

Required: requests, urllib3

Optional (improves functionality):

• httpx – for HTTP/2 support
• lxml – for enhanced SAML parsing
• signxml, cryptography – for signature handling (not required for exploitation)

🚀 Usage

Single target – detect only

python CVE-2026-60206.py -t https://192.168.1.100:7002 --detect

Single target – run all attack vectors

python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode all -u weblogic

Single target – specific attack mode

python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode combo -u admin

Mass scan – detect versions from file

python CVE-2026-60206.py -l targets.txt -o results.json

Mass scan – detect + exploit

python CVE-2026-60206.py -l targets.txt --exploit -o results.csv --threads 20

Replay a captured SAML response

python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode replay --replay-file captured.xml

Use Tor and check connectivity

python CVE-2026-60206.py -t https://192.168.1.100:7002 --tor --check-tor

Send a raw HTTP request from file

python CVE-2026-60206.py -t https://192.168.1.100:7002 -r request.txt --method POST

Quick vulnerability check (non‑exploit)

python CVE-2026-60206.py -t https://192.168.1.100:7002 -c

⚙️ Flags Reference

Options:

Flag	Description
-h, --help	Show help message and exit.
--proxy PROXY	Proxy URL (overridden by --tor if used).
--no-verify	Disable SSL certificate verification.
--cookie COOKIE	Session cookie(s) (e.g., name=value; name2=value2).
--auth AUTH	Basic authentication credentials (USER:PASS).

Target:

Flag	Description
-t, --target TARGET	Single target URL (e.g., https://host:7002).
-l, --list LIST	Target list file for mass scan, or single URL.
-f, --file FILE	Alias for --list.

Request Options:

Flag	Description
-r, --requestfile REQUESTFILE	Load raw HTTP request from file (replaces SAML attacks).
--method METHOD	HTTP method to use (for raw request or single request; default: GET).
--random-agent	Use a random User‑Agent from built‑in list.
-A, --user-agent USER_AGENT	Custom User‑Agent header value.
--tor	Use Tor anonymity network (SOCKS5 by default).
--tor-port TOR_PORT	Tor proxy port (default: 9050).
--tor-type {HTTP,SOCKS4,SOCKS5}	Tor proxy type (default: SOCKS5).
--check-tor	Check if Tor is used properly (exits with verdict).
--delay DELAY	Delay in seconds between each request.
--timeout TIMEOUT	Timeout in seconds (default: 30).
--retries RETRIES	Number of retries on timeout/errors (default: 3).
--retry-on RETRY_ON	Retry request if response content matches regex (e.g., 'captcha').
-dr, --disable-redirects	Disable following HTTP redirects.

Attack Configuration:

Flag	Description
-m, --mode {all,detect,unsigned,xsw,nameid,audience,conditions,combo,replay}	Attack mode (default: all).
--detect	Detect WebLogic version and SAML config only (no attack).
-c, --check	Quick vulnerability check (detect only, exit with verdict).
-u, --user USER	Target user to impersonate (default: weblogic).
--groups GROUPS	Groups to include in SAML assertion (default: Administrators,Monitors).
--issuer ISSUER	SAML Issuer Entity ID.
--audience AUDIENCE	SAML Audience Entity ID.
--relay-state RELAY_STATE	RelayState parameter for SAML POST.
--base64	Base64‑encode the SAML response in POST.
--extra-attrs [NAME=VALUE ...]	Extra SAML attributes (e.g., role=admin).
--replay-file REPLAY_FILE	Path to captured SAML response for replay.
--save-payloads	Save generated SAML payloads to ./payloads/.
--continue-on-success	Continue testing after a successful attack.

Mass Scan (with -l):

Flag	Description
--exploit	Test unsigned SAML assertion (default: detect only).