Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2023-0264 — A small PoC for the Keycloak vulnerability CVE-2023-0264 | Kitploit
Tools/GitHubGitHub/twwd/cve-2023-0264
Vulnerability AnalysisExploitationWeb Application ExploitationAuthentication
GitHubtwwd/cve-2023-0264

CVE-2023-0264

A small PoC for the Keycloak vulnerability CVE-2023-0264

View Repository
723 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

PoC for CVE-2023-0264

Keycloak vulnerability that allows session hijacking during authorization code flow

See https://github.com/advisories/GHSA-9g98-5mj6-f9mv

Prerequisites

  • Docker
  • curl
  • jq
  • python3 or another tool to serve static files on HTTP

Steps to reproduce

  1. Start Keycloak container with ./run-keycloak-container.sh
  2. Create two users alice and mallory with ./create-users.sh
  3. Serve the static files from this repo, e.g., python3 -m http.server 8000
  4. Open http://localhost:8000/index.html in two browser sessions
  5. Start logging in with alice and password test in session 1 and copy the session id from the prompt
  6. Start logging in with mallory and password test in session 2 and paste the session id from alice into the prompt (and press OK)
  7. You should be logged in as alice in session 2 from mallory
Download Tool