CVE-2026-34531 Flask-HTTPAuth 认证绕过漏洞

from flask import Flask from flask_httpauth import HTTPTokenAuth app = Flask(__name__) auth = HTTPTokenAuth(scheme='Bearer') # Simulated user database # Vulnerable condition: A user exists with an empty string as the token users = { "": {"id": 1, "role": "admin"}, "valid_token_123": {"id": 2, "role": "user"} } @auth.verify_token def verify_token(token): # The callback receives an empty string "" if no token is provided # in vulnerable versions. If "" is a valid key in users, # it authenticates the request. if token in users: return users[token] return None @app.route('/protected') @auth.login_required def protected_resource(): # If exploited without a token, this returns the admin user info return f"Logged in as User ID: {auth.current_user()['id']}" if __name__ == '__main__': # To test: Run the server and send a GET request to /protected # WITHOUT the Authorization header. The server will treat # the missing token as an empty string and authenticate as admin. app.run(debug=True)