"dvwa" generates a new CSRF token for each each response. This is how CSRF protection should work. Where as in your script you extract it only once. Thus only your first request from "hydra" uses a correct CSRF token. All subsequent requests use an outdated CSRF token.