Vulnerable code sample

import threading
import time

# This code is a conceptual representation of the vulnerability described in
# CVE-2026-63175, demonstrating the use of mutable class-level variables
# for instance-specific state.

class VulnerableCapture:
    # Vulnerability: State is stored in class variables, not instance variables.
    # This state will be shared across all instances of VulnerableCapture.
    headers = {}
    captured_data = []

    def __init__(self, user_id):
        self.user_id = user_id
        # The constructor does not initialize state, so it defaults to the shared class variables.

    def set_auth_header(self, token):
        """Sets an auth token for a capture, but incorrectly modifies the class variable."""
        print(f"[{self.user_id}] Setting auth token: {token[:10]}...")
        self.headers['Authorization'] = f"Bearer {token}"

    def capture_page(self, url):
        """Simulates a page capture, using the shared class-level state."""
        print(f"[{self.user_id}] Capturing '{url}' with headers: {self.headers}")
        # All instances append to the same shared list.
        self.captured_data.append({
            'captured_by': self.user_id,
            'url': url,
            'headers_used': self.headers.copy()
        })
        time.sleep(0.1)

    def get_results(self):
        """Returns the shared data list."""
        return self.captured_data

# --- Demonstration of the vulnerability in a concurrent context ---

def user_one_session():
    """Simulates a session for User 1 with sensitive data."""
    user1_capture = VulnerableCapture(user_id="user_1")
    user1_capture.set_auth_header("user_1_secret_api_key_xxxxxxxx")
    user1_capture.capture_page("https://api.private.com/data")

def user_two_session():
    """Simulates a session for User 2, which should be isolated."""
    # This user starts their capture slightly after user 1 sets their header.
    time.sleep(0.05)
    user2_capture = VulnerableCapture(user_id="user_2")
    # User 2 makes a request without setting any headers.
    # They expect an anonymous request.
    user2_capture.capture_page("https://api.public.com/data")


if __name__ == "__main__":
    print("--- Starting concurrent captures ---")
    thread1 = threading.Thread(target=user_one_session)
    thread2 = threading.Thread(target=user_two_session)

    thread1.start()
    thread2.start()

    thread1.join()
    thread2.join()

    print("\n--- Vulnerability Demonstration ---")
    # We create a final object just to access the final state of the shared class variables.
    final_state_accessor = VulnerableCapture(user_id="inspector")
    all_captured_data = final_state_accessor.get_results()

    print("\nFinal captured data from the shared state:")
    for item in all_captured_data:
        print(item)

    print("\nAnalysis:")
    print("1. User 2's capture incorrectly used User 1's 'Authorization' header.")
    print("2. The final list contains data from both users, as it was a shared resource.")