Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-18963_analyst — Docker-based lab for reproducing Keycloak CVE-2026-18963, including vulnerable version setup, realm seeding, and source-level workflow analysis with patch comparison and test matrix. | Kitploit
Tools/GitHubGitHub/minh3102011/cve-2026-18963_analyst
Vulnerability AnalysisExploitationWeb SecurityAuthenticationLearning & EducationLabs & Practice
GitHubminh3102011/cve-2026-18963_analyst

CVE-2026-18963_analyst

Docker-based lab for reproducing Keycloak CVE-2026-18963, including vulnerable version setup, realm seeding, and source-level workflow analysis with patch comparison and test matrix.

View Repository
19h 8m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Keycloak CVE-2026-18963 Docker Lab

This lab starts the vulnerable Keycloak version 26.7.1 on localhost and seeds a minimal realm for reproducing the CVE flow.

Investigation documents

  • Workflow analysis: source-level root cause, affected request sequence, patch comparison, and remediation.
  • Evidence and test matrix: acceptance criteria for vulnerable and fixed builds.

Start

root@kitploit:~
docker compose up -d keycloak-vuln
docker compose up --abort-on-container-exit keycloak-lab-init

Keycloak will be exposed at:

  • http://127.0.0.1:18080
  • admin console: admin / admin

Seeded lab objects:

  • realm:
lab
  • client: poc
  • redirect URI: http://localhost/cb
  • user: victim
  • password: OldPassw0rd!

    • Stop

    root@kitploit:~
    docker compose down

    Notes

    • This compose file intentionally runs only the vulnerable version.
    • The init container is idempotent enough for repeated local testing; it skips existing realm/client/user and resets the victim password.
    • Runtime reproduction was not executed in the current review environment because Docker was unavailable. Do not treat static source analysis as a live takeover result until the evidence matrix has been run on an isolated lab.
    Download Tool