CVE-2026-126934 (CVSS 6.5)

Description

Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.

Is your site exposed to CVE-2026-126934?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness Type (CWE)

CWE-348 CWE-348

References

Other References

https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts#L58-L62 https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts#L70-L73 https://github.com/diced/zipline/commit/6bac7e6bb18cb37c1d09f91306c1ffbdca00097c https://github.com/diced/zipline/releases/tag/v4.8.0 https://github.com/diced/zipline/security/advisories/GHSA-v938-v8wg-9497 https://www.vulncheck.com/advisories/zipline-4.3.2-before-4.8.0-rate-limit-bypass-via-spoofed-x-forwarded-for

Frequently Asked Questions

What is CVE-2026-126934? +

Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2026-126934? +

CVE-2026-126934 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

How do I check if I'm vulnerable to CVE-2026-126934? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() …

CVE-2026-123339

Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior …

CVE-2026-93483

In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions …

CVE-2026-9561

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP …

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, …

CVE-2026-61682 9.9

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, …

CVE-2026-126934