CVE-2026-107271 — Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP heade…
Published: 2026-10-07 · CVSS: 6.9 · CVSS 4.0
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7