CVE-2026-1529 Keycloak Exploit Tool

Keycloak: Unauthorized organization registration via improper invitation token validation

---

Disclaimer

This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer systems is illegal and unethical. The authors of this tool are not responsible for any misuse or damage caused by this software.

Created by: f3ds cr3w est, 2002

---

Overview

CVE-2026-1529 is a critical vulnerability in Keycloak that allows unauthorized organization registration through improper invitation token validation. This exploit tool demonstrates the vulnerability by manipulating JWT tokens to register users in unauthorized organizations.

Technical Details

• CVE ID: CVE-2026-1529
• Affected Software: Keycloak (org.keycloak.services.resources.organizations)
• CVSS Score: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Impact: Unauthorized access to organization resources

Vulnerability Description

The vulnerability exists in the JWT token validation process for organization invitations. Attackers can manipulate the org_id and email fields in the JWT payload, allowing them to register users in any organization without proper authorization.

---

Installation

Prerequisites

• Python 3.7 or higher
• pip package manager

Setup

1. Clone or download the exploit tool:

git clone https://github.com/ninjazan420/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation
cd CVE-2026-1529-POC

2. Install required dependencies:

pip install -r requirements.txt

3. Make the exploit script executable:

chmod +x keycloak-exploit.py

---

Usage

Basic Usage

# Standard usage with target URL
python keycloak-exploit.py https://target-keycloak.com

# Show help
python keycloak-exploit.py -h

# Show version
python keycloak-exploit.py -v

Advanced Usage

# Use custom invitation token
python keycloak-exploit.py -t eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 https://target-keycloak.com

# Use custom organization ID
python keycloak-exploit.py -o custom_org_id https://target-keycloak.com

# Use custom configuration file
python keycloak-exploit.py -c custom_config.json https://target-keycloak.com

# Enable debug logging
python keycloak-exploit.py -d https://target-keycloak.com

Command Line Options

Option	Description	Required
target	Target Keycloak URL (IP or domain)	Yes
-t, --token	Custom invitation token to use	No
-o, --org-id	Custom organization ID	No
-c, --config	Path to configuration file	No
-d, --debug	Enable debug logging	No
-v, --version	Show version information	No
-h, --help	Show help message	No

---

Output

Successful Exploit

When the exploit is successful, you'll see output like:

=============================================================
CVE-2026-1529 EXPLOIT RESULTS
=============================================================
✓ Target is vulnerable to CVE-2026-1529

🎯 EXPLOIT SUCCESSFUL!
Username: admin_user_2026
Password: KeycloakCVE2026!
Email: [email protected]
Login Link: https://target-keycloak.com/realms/master/account

📄 Report saved to: output/reports/exploit_report_20260210_134556.txt

🔐 Use the provided credentials to access the Keycloak instance!
⚠️  This demonstrates unauthorized access due to CVE-2026-1529

=============================================================
by f3ds cr3w est, 2002
=============================================================

Failed Exploit

If the exploit fails, you'll see:

=============================================================
CVE-2026-1529 EXPLOIT RESULTS
=============================================================
✗ Target is not vulnerable

❌ EXPLOIT FAILED!
Check logs for details: logs/exploit.log

---

Project Structure

CVE-2026-1529-POC/
├── keycloak-exploit.py          # Main exploit script
├── requirements.txt             # Python dependencies
├── README.md                   # This file
├── config/
│   └── default_config.json     # Default configuration
├── utils/
│   ├── jwt_utils.py            # JWT manipulation utilities
│   ├── http_utils.py           # HTTP client utilities
│   └── crypto_utils.py         # Cryptographic utilities
├── output/
│   ├── logs/                   # Log files
│   └── reports/                # Exploit reports

---

Configuration

Default Configuration

The tool uses a default configuration file (config/default_config.json) with the following settings:

{
  "exploit": {
    "default_username": "admin_user_2026",
    "default_password": "KeycloakCVE2026!",
    "default_email": "[email protected]",
    "timeout": 30,
    "max_retries": 3
  },
  "jwt": {
    "algorithm": "HS256",
    "secret_key": "keycloak-cve-2026-1529-exploit",
    "token_expiry": 3600
  },
  "target": {
    "endpoints": {
      "realms": "/realms",
      "organizations": "/organizations",
      "register": "/register",
      "login": "/login"
    }
  },
  "output": {
    "log_level": "INFO",
    "save_reports": true,
    "report_format": "txt"
  }
}

Custom Configuration

You can create a custom configuration file and use it with the -c option:

{
  "exploit": {
    "default_username": "custom_user",
    "default_password": "CustomPassword123!",
    "default_email": "[email protected]",
    "timeout": 60,
    "max_retries": 5
  },
  "jwt": {
    "algorithm": "HS256",
    "secret_key": "custom-secret-key",
    "token_expiry": 7200
  }
}

---

Technical Details

Exploit Process

1. Target Analysis: Check if the target is a vulnerable Keycloak instance
2. Token Generation: Generate or use a custom invitation token
3. Token Manipulation: Manipulate the JWT payload to change organization ID
4. User Registration: Register a user using the manipulated token
5. Login Testing: Verify the created user can log in
6. Report Generation: Create a detailed exploit report

JWT Manipulation

The tool exploits the improper JWT validation by:

1. Decoding the JWT token without signature verification
2. Modifying the org_id field to target a different organization
3. Modifying the email field if needed
4. Re-encoding the token with the manipulated payload

Security Considerations

• The tool uses proper error handling and logging
• All network requests include appropriate headers
• Input validation is performed on all user inputs
• The tool respects the target's server response codes

---

Troubleshooting

Common Issues

1. Connection Errors

   • Check if the target URL is accessible
   • Verify the target is a Keycloak instance
   • Check network connectivity and firewall settings

2. Token Validation Errors

   • Ensure the token format is correct
   • Check if the token contains required fields (org_id, email, invitation_type)
   • Verify the token is not expired

3. Registration Failures

   • Check if the registration endpoint is accessible
   • Verify the manipulated token format
   • Check if the target has organization registration enabled

Debug Mode

Enable debug logging for detailed troubleshooting:

python keycloak-exploit.py -d https://target-keycloak.com

Log Files

• Main log: logs/exploit.log
• Reports: output/reports/exploit_report_YYYYMMDD_HHMMSS.txt

---

Testing Methodology

Vulnerability Assessment

The tool performs the following checks: