hexissam/cve-2026-4282-scannerNon-intrusive version-based vulnerability scanner for CVE-2026-4282 (Keycloak SingleUseObjectProvider isolation flaw enabling authorization code forgery & privilege escalation)
A non-intrusive, version-based vulnerability scanner for CVE-2026-4282, affecting Keycloak and Red Hat Build of Keycloak (RHBK).
⚠️ Disclaimer: This tool is intended strictly for authorized security research, penetration testing, and defensive vulnerability management. Only run it against systems you own or have explicit written permission to test. This scanner performs no exploitation — it only inspects publicly served, unauthenticated information to fingerprint the running version.
CVE-2026-4282 — Improper Isolation or Compartmentalization (CWE-653)
Keycloak's SingleUseObjectProvider, a global key-value store used internally by the authentication server, lacks proper type and namespace isolation between stored objects. Because entries from different internal subsystems are not adequately segregated, an unauthenticated attacker can manipulate this shared store to forge OAuth2/OpenID Connect authorization codes.
Since authorization codes are exchanged for access tokens, a forged code can be used to mint admin-capable access tokens, resulting in full privilege escalation within the Keycloak instance — without the attacker ever needing valid credentials.
SingleUseObjectProvider (global KV store)GET request to well-known Keycloak endpoints (the same traffic a browser generates when loading the login page).26.5.7) and reports whether the target is likely vulnerable, likely patched, or undetermined.What it does NOT do:
sudo apt update
sudo apt install -y git python3 python3-pip
git clone https://github.com/hexissam/CVE-2026-4282-Scanner.git
cd CVE-2026-4282-Scanner
pip3 install -r requirements.txt
python3 scanner.py -u https://sso.example.com
| Flag | Description |
|---|---|
-u, --url | Base URL of the target Keycloak server (required) |
-t, --timeout | Request timeout in seconds (default: 8) |
--no-verify-ssl | Disable SSL certificate verification (self-signed certs) |
[*] Target: https://sso.example.com
[*] Timestamp: 2026-08-09T12:00:00
[+] Confirmed the target is running Keycloak.
[*] Detected version: 26.5.4 (source: /admin/master/console/)
[-] Version 26.5.4 may be VULNERABLE to CVE-2026-4282 (older than 26.5.7).
[!] It is recommended to upgrade immediately to Keycloak 26.5.7 or later,
or review the official Red Hat advisory referenced in README.md.
[*] This scan relies solely on public, non-interactive data.
No exploit payload or authentication bypass attempt was sent.
This project is provided for educational and authorized security research purposes only. The author is not responsible for any misuse or damage caused by this tool. Unauthorized scanning or testing of systems you do not own or have explicit permission to assess is illegal in most jurisdictions.
Developed by: issam junior (@hexissam) Vulnerability discovered/disclosed by: Red Hat, Inc.