alt3kx/cve-2026-18963Ferramenta de deteção e verificação para CVE-2026-18963, uma bypass do estado de reset-credentials do Keycloak. Realiza fingerprinting de versão, enumeração de realm/client/user e testa se a pré-condição do action-token é aplicada, para avaliações autorizadas.
https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e
python3 kc-resetforge.py -h
usage: kc-resetforge.py [-h] [--target TARGET] [--targets-file TARGETS_FILE] [--port PORT] [--realm REALM]
[--client-id CLIENT_ID] [--username USERNAME] [--new-password NEW_PASSWORD] [--skip-enum]
[--enum-only] [--kc-version] [--kc-reset-link] [--corpus-dir CORPUS_DIR] [--label LABEL]
[--enum-realms] [--no-enum-realms] [--enum-clients] [--no-enum-clients] [--enum-users]
[--no-enum-users] [--realm-wordlist REALM_WORDLIST] [--client-wordlist CLIENT_WORDLIST]
[--user-wordlist USER_WORDLIST] [--enum-users-client-id ENUM_USERS_CLIENT_ID]
[--verify-login] [--no-verify-login] [--verify-client-id VERIFY_CLIENT_ID]
[--timeout TIMEOUT] [--request-delay REQUEST_DELAY] [--output-dir OUTPUT_DIR]
[--proxy PROXY] [-d] [-y] [--json-out JSON_OUT]
CVE-2026-18963 Keycloak recon + exploit framework (own infra only)
options:
-h, --help show this help message and exit
--target TARGET Single target: bare host/IP, host:port, or a full http(s)://host[:port] URL. Scheme and port
are auto-detected if omitted (tries https then http; defaults to 443/80 respectively).
Mutually exclusive with --targets-file.
--targets-file TARGETS_FILE
Path to a file with one target per line, same flexible formats as --target ('#' comments
allowed). Runs recon+exploit against every target in turn.
--port PORT Override port for --target (or a fallback for --targets-file lines without their own port).
Per-line ports in --targets-file always take precedence.
--realm REALM Realm to target. If omitted, auto-selected from recon results.
--client-id CLIENT_ID
OIDC client_id to use. If omitted, auto-selected from recon results.
--username USERNAME Username to target. If omitted, auto-selected from recon results.
--new-password NEW_PASSWORD
Password to set for the target user (default: 'Test123!')
--skip-enum Skip recon entirely; --realm/--client-id/--username become required.
--enum-only Run recon and print results, but do not attempt exploitation.
--kc-version Only run the Keycloak version recon phase (fingerprint + corpus match + patch status) and
exit - skips realm/client/user enumeration and exploitation entirely. Works with both
--target and --targets-file.
--kc-reset-link Only check whether the self-service password-reset ('Forgot Password?' /
resetPasswordAllowed) flow is exposed, then exit - a single non-destructive GET, no username
needed. Auto-discovers realm/client via a light realm+client recon unless --realm/--client-
id are given explicitly. Skips exploitation. Works with both --target and --targets-file.
--corpus-dir CORPUS_DIR
Directory of known-version fingerprints for exact version matching (default:
kc_version_corpus).
--label LABEL Save THIS target's fingerprint into the corpus under this version label instead of matching
an unknown version. Use on an instance of known version.
--enum-realms Enumerate realm names (default: on during recon).
--no-enum-realms
--enum-clients Enumerate client IDs per realm (default: on during recon).
--no-enum-clients
--enum-users Enumerate usernames per realm (default: on during recon).
--no-enum-users
--realm-wordlist REALM_WORDLIST
--client-wordlist CLIENT_WORDLIST
--user-wordlist USER_WORDLIST
--enum-users-client-id ENUM_USERS_CLIENT_ID
Client used for the username-enumeration direct-grant probe (default: admin-cli).
--verify-login After a password change, confirm the new credentials via a password-grant token request
(default: on).
--no-verify-login
--verify-client-id VERIFY_CLIENT_ID
Client used for the verification password grant.
--timeout TIMEOUT
--request-delay REQUEST_DELAY
Seconds to wait before each request in the exploit chain (default: 0.4). Keycloak's login-
flow state can be timing-sensitive across the reset/restart/selector replay steps; a small
delay makes the chain more reliable. 0 to disable.
--output-dir OUTPUT_DIR
--proxy PROXY Route through an HTTP(S) proxy: 'burp' (127.0.0.1:8080 shorthand), a bare host:port, or a
full http(s):// URL.
-d, --debug Verbose debug logging of requests/responses/enum probes
-y, --yes Skip the 'Continue with this target?' prompt. Required for non-interactive use (scripts,
--targets-file with multiple targets, CI).
--json-out JSON_OUT Write a JSON report of recon + exploit results to this path.
kc-resetforge — CVE-2026-18963 Keycloak recon + exploit tool (own infra only)
Usage
-----
Fully automatic (recon -> auto-pick target -> exploit -> verify):
python3 kc-resetforge.py --target https://localhost:9990 --proxy burp -d
Recon only:
python3 kc-resetforge.py --target https://localhost:9990 --enum-only -d
Version + patch-status check only, across many hosts:
python3 kc-resetforge.py --targets-file targets.txt --kc-version
Skip recon, target directly:
python3 kc-resetforge.py --target https://localhost:9990 --realm master \
--client-id account --username admin --skip-enum
Requires: requests, beautifulsoup4, and optionally rich (pip install --break-system-packages)
| Campo | Valor |
|---|---|
| CVE | CVE-2026-18963 |
| Severidade | Crítica |
| CVSS | 9.1 |
| CWE | CWE-640 (Mecanismo Fraco de Recuperação de Senha) |
| Componente | Keycloak — fluxo de autenticação reset-credentials |
| Impacto | Tomada de conta não autenticada e sem interação (incluindo contas de administrador) |
| Versão corrigida | Keycloak 26.7.2 (upstream) / RHBK 26.4.15-1, 26.6.6-1 |
26.7.226.4.15-1 / imagens 26.4-2326.6.6-1 / imagens 26.6-12kc-resetforge é uma ferramenta de detecção/verificação. Ela confirma se o fluxo reset-credentials de um alvo impõe corretamente a pré-condição do token de ação (corrigido) ou não (vulnerável), para uso em avaliações autorizadas. A análise vinculada abaixo cobre o mecanismo e a metodologia de reprodução com a profundidade adequada para divulgação pública.