Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
CVE-2026-18963_analyst — Docker-based lab for reproducing Keycloak CVE-2026-18963, including vulnerable version setup, realm seeding, and source-level workflow analysis with patch comparison and test matrix. | Kitploit
Strumenti/GitHubGitHub/minh3102011/cve-2026-18963_analyst
Vulnerability AnalysisExploitationWeb SecurityAuthenticationLearning & EducationLabs & Practice
GitHubminh3102011/cve-2026-18963_analyst

CVE-2026-18963_analyst

Docker-based lab for reproducing Keycloak CVE-2026-18963, including vulnerable version setup, realm seeding, and source-level workflow analysis with patch comparison and test matrix.

Vedi Repository
418 giorni faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi
Contenuto non disponibile nella lingua richiesta. Visualizzazione della versione inglese.

Keycloak

GitHub Release OpenSSF Best Practices CLOMonitor OpenSSF Scorecard Artifact Hub GitHub Repo stars GitHub commit activity

Translation status

Open Source Identity and Access Management

Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.

Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more.

Help and Documentation

  • Documentation
  • User Mailing List - Mailing list for help and general questions about Keycloak
  • Join #keycloak for general questions, or #keycloak-dev on Slack for design and development discussions, by creating an account at https://slack.cncf.io/.

Reporting Security Vulnerabilities

If you have found a security vulnerability, please look at the instructions on how to properly report it.

Reporting an issue

If you believe you have discovered a defect in Keycloak, please open an issue. Please remember to provide a good summary, description as well as steps to reproduce the issue.

Getting started

To run Keycloak, download the distribution from our website. Unzip and run:

root@kitploit:~
bin/kc.[sh|bat] start-dev

Alternatively, you can use the Docker image by running:

root@kitploit:~
docker run quay.io/keycloak/keycloak start-dev

For more details refer to the Keycloak Documentation.

Building from Source

To build from source, refer to the building and working with the code base guide.

Testing

To run tests, refer to the running tests guide.

Writing Tests

To write tests, refer to the writing tests guide.

Contributing

Before contributing to Keycloak, please read our contributing guidelines. Participation in the Keycloak project is governed by the CNCF Code of Conduct.

Joining a community meeting is a great way to get involved and help shape the future of Keycloak.

Code of Conduct

We are committed to providing a safe, welcoming, and constructive environment for all Keycloak contributors and users. To protect this space, we actively enforce our Code of Conduct. If you wish to report an incident or appeal a moderation decision, please email [email protected].

Other Keycloak Projects

  • Keycloak - Keycloak Server and Java adapters
  • Keycloak Client - Keycloak client libraries
  • Keycloak QuickStarts - QuickStarts for getting started with Keycloak
  • Keycloak Node.js Connect - Node.js adapter for Keycloak

License

  • Apache License, Version 2.0

Keycloak CVE-2026-18963 Docker Lab

This lab starts the vulnerable Keycloak version 26.7.1 on localhost and seeds a minimal realm for reproducing the CVE flow.

Investigation documents

  • Workflow analysis: source-level root cause, affected request sequence, patch comparison, and remediation.
  • Evidence and test matrix: acceptance criteria for vulnerable and fixed builds.

Start

root@kitploit:~
docker compose up -d keycloak-vuln
docker compose up --abort-on-container-exit keycloak-lab-init

Keycloak will be exposed at:

  • http://127.0.0.1:18080
  • admin console: admin / admin

Seeded lab objects:

  • realm: lab
  • client: poc
  • redirect URI: http://localhost/cb
  • user: victim
  • password: OldPassw0rd!

Stop

root@kitploit:~
docker compose down

Notes

  • This compose file intentionally runs only the vulnerable version.
  • The init container is idempotent enough for repeated local testing; it skips existing realm/client/user and resets the victim password.
  • Runtime reproduction was not executed in the current review environment because Docker was unavailable. Do not treat static source analysis as a live takeover result until the evidence matrix has been run on an isolated lab.
Scarica lo strumento