0x240x23elu/CVE-2026-1529

GitHubRepository PoCExploit

PoC files

14 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python tool designed to exploit CVE-2026-1529 in Keycloak. It performs vulnerability detection, JWT token manipulation, unauthorized user registration, and login verification against a target Keycloak instance.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence is a Python-based Proof of Concept (PoC) for CVE-2026-1529, a Keycloak vulnerability. The code's behavior is consistent with its documented purpose: it manipulates JWT invitation tokens to attempt unauthorized organization registration on a target Keycloak instance. All actions, including HTTP requests, token manipulation, and user registration, are directed at the operator-supplied target URL. No concealed, unrelated, or operator-harming behavior was observed. The presence of two uninspected binary files (archives) limits the review scope, but the readable source code shows no backdoor indicators.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareKeycloak
Attack typesauthentication bypassprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary purpose is to exploit CVE-2026-1529. The main script (keycloak-exploit.py) contains functions to manipulate JWT tokens, register unauthorized users, and verify access, which are actions intended to exercise the vulnerability, not just detect it.

keycloak-exploit.py:318-410README.md:7

Requirements

  • A target Keycloak instance with the organization invitation feature enabled.README.md:35
  • Python 3.7+ with requests, urllib3, and PyJWT libraries installed.requirements.txt:1-3

Observed behavior

  • Checks if the target is a vulnerable Keycloak instance by testing accessibility and organization endpoints.keycloak-exploit.py:105-131
  • Generates or accepts a JWT invitation token and manipulates its payload to change the organization ID and email.keycloak-exploit.py:152-174
  • Submits a user registration request with the manipulated token to bypass organization validation.keycloak-exploit.py:176-204
  • Tests login with the newly created credentials and generates a login link for the compromised instance.keycloak-exploit.py:206-240
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://target-keycloak.comExample target URL used in documentation and code comments; all network operations are directed at the operator-supplied target.README.md:108keycloak-exploit.py:419
Email
0x240x23elu@protonmail.comContact email listed in the README for questions or security concerns.README.md:459
Url
https://github.com/ninjazan420/CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validationReference URL in the README, likely pointing to a related or original PoC repository.README.md:465
Review boundaries

What the analysis did not establish

  • Two binary archive files (files (1).zip, readme.zip) were not analyzed; their contents are unknown.
  • Nine additional text files from the repository were not included in the evidence packet.
  • The utility modules (jwt_utils.py, http_utils.py, crypto_utils.py) referenced by the main script are not provided, so the exact implementation of token manipulation and HTTP requests is not visible.
  • Two binary archive files ('files (1).zip' and 'readme.zip') were present in the artifact but were not inspected. Their contents could contain additional behavior not visible in the reviewed text files.
  • The utility modules (utils/jwt_utils.py, utils/http_utils.py, utils/crypto_utils.py) referenced by the main script were not included in the provided text evidence, so their exact implementation could not be verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1