CVE-2022-26138

This PoC demonstrates an authentication bypass vulnerability in Atlassian Questions For Confluence due to hardcoded credentials. The exploit involves using predefined credentials to log in as a user with access to the confluence-users group.

This repository contains a Go-based scanner for CVE-2022-26138, which checks for the presence of a hardcoded password vulnerability in Confluence. It supports both single and batch scanning modes and logs vulnerable hosts.

This repository documents CVE-2022-26138, a hardcoded credential vulnerability in the 'Questions for Confluence' app. The app creates a user account with a fixed username and password, allowing unauthorized access to Confluence content.

This PoC checks for CVE-2022-26138, an authentication bypass vulnerability in Atlassian Confluence. It sends a crafted login request and checks for a 302 redirect to determine vulnerability.