george0papasotiriou/cve-2026-11107-insecure-direct-object-reference-with-predictable-uuidv1Educational CVE-2026-11107 demo with vulnerable Flask API and exploit script, showing how predictable UUIDv1 identifiers enable insecure direct object references.
# idor_server.py - API with UUIDv1 user IDs
import uuid, time
from flask import Flask, request, jsonify
app = Flask(__name__)
# Generate predictable UUIDv1 based on timestamp + MAC
users = {
str(uuid.uuid1()): {"name": "Alice", "data": "private1"},
str(uuid.uuid1()): {"name": "Bob", "data": "private2"},
}
@app.route('/user/<user_id>')
def get_user(user_id):
if user_id in users:
return jsonify(users[user_id])
return "Not found", 404
if __name__ == '__main__':
app.run(port=5000)
A REST API uses UUID version 1 as direct object references for user resources. UUIDv1 contains a timestamp component, making it highly predictable. An attacker can enumerate valid user UUIDs and access private data.
pip install flask
python idor_server.py
python exploit_idor_uuid.py