0x240x23elu
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHub0x240x23elu/CVE-2026-1529
Repository PoCStars: 0Created 2026-02-11ExploitCVE-2026-152914 files
Analysis
Technical assessment
The artifact is a Python tool designed to exploit CVE-2026-1529 in Keycloak. It performs vulnerability detection, JWT token manipulation, unauthorized user registration, and login verification against a target Keycloak instance.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a Python-based Proof of Concept (PoC) for CVE-2026-1529, a Keycloak vulnerability. The code's behavior is consistent with its documented purpose: it manipulates JWT invitation tokens to attempt unauthorized organization registration on a target Keycloak instance. All actions, including HTTP requests, token manipulation, and user registration, are directed at the operator-supplied target URL. No concealed, unrelated, or operator-harming behavior was observed. The presence of two uninspected binary files (archives) limits the review scope, but the readable source code shows no backdoor indicators.
Classification basis and observed behavior
Classification basis
The artifact's primary purpose is to exploit CVE-2026-1529. The main script (keycloak-exploit.py) contains functions to manipulate JWT tokens, register unauthorized users, and verify access, which are actions intended to exercise the vulnerability, not just detect it.
keycloak-exploit.py:318-410README.md:7Requirements
- A target Keycloak instance with the organization invitation feature enabled.
README.md:35 - Python 3.7+ with requests, urllib3, and PyJWT libraries installed.
requirements.txt:1-3
Observed behavior
- Checks if the target is a vulnerable Keycloak instance by testing accessibility and organization endpoints.
keycloak-exploit.py:105-131 - Generates or accepts a JWT invitation token and manipulates its payload to change the organization ID and email.
keycloak-exploit.py:152-174 - Submits a user registration request with the manipulated token to bypass organization validation.
keycloak-exploit.py:176-204 - Tests login with the newly created credentials and generates a login link for the compromised instance.
keycloak-exploit.py:206-240
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExample target URL used in documentation and code comments; all network operations are directed at the operator-supplied target.
README.md:108keycloak-exploit.py:419 - Payload withheldContact email listed in the README for questions or security concerns.
README.md:459 - Url
- Payload withheldReference URL in the README, likely pointing to a related or original PoC repository.
README.md:465
What the analysis did not establish
- Two binary archive files (files (1).zip, readme.zip) were not analyzed; their contents are unknown.
- Nine additional text files from the repository were not included in the evidence packet.
- The utility modules (jwt_utils.py, http_utils.py, crypto_utils.py) referenced by the main script are not provided, so the exact implementation of token manipulation and HTTP requests is not visible.
- Two binary archive files ('files (1).zip' and 'readme.zip') were present in the artifact but were not inspected. Their contents could contain additional behavior not visible in the reviewed text files.
- The utility modules (utils/jwt_utils.py, utils/http_utils.py, utils/crypto_utils.py) referenced by the main script were not included in the provided text evidence, so their exact implementation could not be verified.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.