CVE-2026-63770High· 7.5▾ TwilightGlance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-h53f-rm2w-w7rgMedium· 5.3Echo: X-Real-IP extractor trusts the header value instead of the sending peer
GHSA-7cgw-qmxx-7fc2Medium· 4.8Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
CVE-2026-112378Medium· 4.3Use of Less Trusted Source in GitLab
CVE-2026-114474Medium· 5.9Use of Less Trusted Source in hMailServer
CVE-2026-114437Medium· 4.8chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
CVE-2026-107567High· 7.5Use of Less Trusted Source in hMailServer