{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "GET/POST /realms/cvetest/login-actions/reset-credentials (Keycloak reset-credentials flow, ResetCredentialEmail execution)",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "docker(rootless)",
    "keycloak(start-dev,H2)",
    "smtp-sink(python)"
  ],
  "target_identity": {
    "repository_url": "https://github.com/keycloak/keycloak",
    "commit_sha": "73f08b397f193712b26d317210dce99898129709",
    "fix_commit": "cf6e4c8be318f1e38c4001730fe6db6930dad050",
    "target_digest": "5785857f1c5e0876f3fcbfc0ba2ab48a279546d3fe06cc99b62a6ae3009a1d68",
    "runtime_digest": "sha256:f1f1f01e472c8a78df40d8f2a49a925274eda4d3d80d5f6edbb5c880ee3c01c6",
    "fixed_image_digest": "sha256:831330513f55695572286e521f94fcd3c7e285250ed5b848090265a33192f669",
    "vulnerable_server_version": "26.7.1",
    "fixed_server_version": "26.7.2",
    "platform": "linux",
    "architecture": "x86_64"
  },
  "attempt_results": {
    "vulnerable": " attempt1=EXPLOITED; attempt2=EXPLOITED;",
    "fixed": " attempt1=BLOCKED; attempt2=BLOCKED;",
    "overall": "confirmed"
  },
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/keycloak-vuln.log",
    "logs/keycloak-fixed.log",
    "logs/smtp-capture-final.log",
    "logs/vuln-attempt-1.log",
    "logs/vuln-attempt-2.log",
    "logs/fixed-attempt-1.log",
    "logs/fixed-attempt-2.log",
    "logs/http/vuln-1/step5-refresh.html",
    "logs/http/vuln-1/step6.hdr",
    "logs/http/vuln-1/step7.hdr",
    "logs/http/fixed-1/step5-refresh.html"
  ],
  "notes": "CVE-2026-18963 repro exit code 0"
}