CVE-2026-126934

Description

Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/diced/zipline/security/advisories/GHSA-v938-v8wg-9497 ↗
• https://github.com/diced/zipline/commit/6bac7e6bb18cb37c1d09f91306c1ffbdca00097c ↗
• https://github.com/diced/zipline/releases/tag/v4.8.0 ↗
• https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts#L58-L62 ↗
• https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts#L70-L73 ↗
• https://www.vulncheck.com/advisories/zipline-4.3.2-before-4.8.0-rate-limit-bypass-via-spoofed-x-forwarded-for ↗