Authorization Bypass in JeecgBoot 3.9.1 mLogin Endpoint

This repository is a small standalone Python proof-of-concept exploit for a JeecgBoot authentication weakness identified in the code/comments as CVE-2026-8196. The repository contains 4 files: a Python exploit (exploit.py), README, license, and .gitignore. The only code file and clear entry point is exploit.py. The exploit’s purpose is to demonstrate that JeecgBoot’s standard login endpoint (/sys/login) enforces captcha, while an alternate endpoint (/sys/mLogin) accepts the same username/password pair without captcha validation. The script uses requests.Session with JSON POST requests and a custom User-Agent to interact with the target. It provides three main capabilities: (1) test the normal login flow for comparison, (2) authenticate through /sys/mLogin to demonstrate captcha bypass, and (3) optionally iterate through a password list to demonstrate brute-force feasibility when rate limiting or account lockout are absent. Structurally, the code defines a JeecgBootBruteForcePoC class with methods test_standard_login(), mlogin(), and brute_force(). The main() function sets a placeholder target URL, a username, runs the standard login test, then runs the bypass test against /sys/mLogin. The brute-force routine is present but commented out in main, indicating the repository is more than a detector: it contains working exploit logic for repeated authentication attempts. No external command execution, shell payload, persistence, or post-exploitation logic is present. The exploit is operational but basic: it directly performs HTTP authentication attempts and prints returned JSON, including successful login result data. Fingerprintable targets in the code are the placeholder base URL http://your-target:8080/jeecg-boot and the two application paths /sys/login and /sys/mLogin.