## https://sploitus.com/exploit?id=3A9300DD-8DA3-50F7-9D5A-E545FE9FE01D
# CVE-2026-4282-Scanner
A non-intrusive, version-based vulnerability scanner for **CVE-2026-4282**, affecting **Keycloak** and **Red Hat Build of Keycloak (RHBK)**.
> ⚠️ **Disclaimer:** This tool is intended strictly for authorized security research, penetration testing, and defensive vulnerability management. Only run it against systems you own or have explicit written permission to test. This scanner performs **no exploitation** — it only inspects publicly served, unauthenticated information to fingerprint the running version.
---
## About the Vulnerability
**CVE-2026-4282** — *Improper Isolation or Compartmentalization (CWE-653)*
Keycloak's `SingleUseObjectProvider`, a global key-value store used internally by the authentication server, lacks proper type and namespace isolation between stored objects. Because entries from different internal subsystems are not adequately segregated, an **unauthenticated attacker** can manipulate this shared store to **forge OAuth2/OpenID Connect authorization codes**.
Since authorization codes are exchanged for access tokens, a forged code can be used to mint **admin-capable access tokens**, resulting in full **privilege escalation** within the Keycloak instance — without the attacker ever needing valid credentials.
- **CVSS 3.1 Base Score:** 7.4 (High) — Network attack vector, no privileges required, no user interaction, high attack complexity
- **CWE:** CWE-653 — Improper Isolation or Compartmentalization
- **Affected component:** `SingleUseObjectProvider` (global KV store)
- **Fixed in:** Keycloak / RHBK **26.5.7** and later
### Official Sources
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-4282
- Red Hat advisory: https://access.redhat.com/security/cve/CVE-2026-4282
- Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2448061
- Keycloak 26.5.7 release notes: https://www.keycloak.org/2026/04/keycloak-2657-released
---
## What This Scanner Does
1. Sends a standard, unauthenticated `GET` request to well-known Keycloak endpoints (the same traffic a browser generates when loading the login page).
2. Confirms the target is actually running Keycloak.
3. Attempts to fingerprint the deployed version from public response data (asset paths, headers).
4. Compares the detected version against the known fixed version (`26.5.7`) and reports whether the target is likely vulnerable, likely patched, or undetermined.
**What it does NOT do:**
- It does not forge authorization codes.
- It does not attempt authentication bypass.
- It does not send any malicious or malformed payloads.
---
## Installation (Linux)
```bash
sudo apt update
sudo apt install -y git python3 python3-pip
git clone https://github.com/hexissam/CVE-2026-4282-Scanner.git
cd CVE-2026-4282-Scanner
pip3 install -r requirements.txt
```
## Usage
```bash
python3 scanner.py -u https://sso.example.com
```
### Options
| Flag | Description |
|------|-------------|
| `-u`, `--url` | Base URL of the target Keycloak server (required) |
| `-t`, `--timeout` | Request timeout in seconds (default: 8) |
| `--no-verify-ssl` | Disable SSL certificate verification (self-signed certs) |
### Example Output
```
[*] Target: https://sso.example.com
[*] Timestamp: 2026-08-09T12:00:00
[+] Confirmed the target is running Keycloak.
[*] Detected version: 26.5.4 (source: /admin/master/console/)
[-] Version 26.5.4 may be VULNERABLE to CVE-2026-4282 (older than 26.5.7).
[!] It is recommended to upgrade immediately to Keycloak 26.5.7 or later,
or review the official Red Hat advisory referenced in README.md.
[*] This scan relies solely on public, non-interactive data.
No exploit payload or authentication bypass attempt was sent.
```
---
## Remediation
- Upgrade Keycloak / RHBK to version **26.5.7 or later**.
- If immediate upgrade is not possible, monitor authentication logs for anomalous authorization-code redemption patterns and restrict network exposure of the Keycloak admin console.
- Review the official Red Hat advisory for any additional mitigation guidance.
---
## Legal Notice
This project is provided for **educational and authorized security research purposes only**. The author is not responsible for any misuse or damage caused by this tool. Unauthorized scanning or testing of systems you do not own or have explicit permission to assess is illegal in most jurisdictions.
---
## Credits
**Developed by:** issam junior ([@hexissam](https://github.com/hexissam))
**Vulnerability discovered/disclosed by:** Red Hat, Inc.