4minx/CVE-2026-72898 ? reverse-engineered prompt

Build me a small Python tool that can check whether a Metabase server is affected by the unauthenticated password reset SQL injection issue described in CVE 2026 72898.

I want it to take either one target URL or a text file with many targets, try the reset password endpoint, then confirm whether the target looks vulnerable by checking for a valid admin session response. If it is vulnerable, print the forged session details clearly, and save results to an output file if I ask for one. If the target is patched, not vulnerable, or something goes wrong, report that in a simple readable way too.

Please make it easy to run from the command line, use requests, and keep the output friendly for security testing and lab use only. If you need to check the current Metabase docs or known advisories online, feel free to do that.