Repository navigation
Conversation
robert-doyensec
suggested changes
Oct 14, 2026
Comment on lines
+70
to
+93
| ### 2. Automated Side-by-Side Verification with Tsunami | ||
|
|
||
| ```bash | ||
| for port in 8080 8081; do | ||
| echo "=== Scanning Port $port ===" | ||
| docker run --rm --net=host \ | ||
| --entrypoint /usr/bin/tsunami \ | ||
| -v /tmp:/tmp \ | ||
| ghcr.io/google/tsunami-scanner-full \ | ||
| --ip-v4-target=127.0.0.1 \ | ||
| --detectors-include=Keycloak_CVE_2026_18963 \ | ||
| --port-ranges-target="${port}" \ | ||
| --scan-results-local-output-format=JSON \ | ||
| --scan-results-local-output-filename="/tmp/tsunami-out-${port}.json" 2>&1 | grep "# of detected vulnerability:" | ||
| done | ||
| ``` | ||
|
|
||
| **Expected Output:** | ||
| ```text | ||
| === Scanning Port 8080 === | ||
| # of detected vulnerability: 1. | ||
| === Scanning Port 8081 === | ||
| # of detected vulnerability: 0. | ||
| ``` |
Contributor
There was a problem hiding this comment.
Could you replace this section with a section for how to reproduce the vulnerability without using tsunami (for example, with curl)?
Comment on lines
+27
to
+41
| ### Enable Reset-Credentials ("Forgot Password") on Both Instances | ||
|
|
||
| By default, Keycloak disables `resetPasswordAllowed` on the `master` realm. Enable it on both containers after startup: | ||
|
|
||
| ```bash | ||
| # Enable on Vulnerable Instance (Port 8080) | ||
| docker exec keycloak_vulnerable_instance /opt/keycloak/bin/kcadm.sh update realms/master \ | ||
| -s resetPasswordAllowed=true \ | ||
| --server http://localhost:8080 --realm master --user admin --password admin | ||
|
|
||
| # Enable on Patched Instance (Port 8081) | ||
| docker exec keycloak_patched_instance /opt/keycloak/bin/kcadm.sh update realms/master \ | ||
| -s resetPasswordAllowed=true \ | ||
| --server http://localhost:8081 --realm master --user admin --password admin | ||
| ``` |
Contributor
There was a problem hiding this comment.
Could you put these commands into the docker-compose file instead so that it runs automatically?
dyeddala
force-pushed
the
feature/CVE-2026-18963
branch
from
October 16, 2026 09:40
ccc9f2b to
a4966de
Compare
Contributor
Author
|
Addressed.As per the comments. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please review.