Read the docs
TI-2026-69198 Aliases CVE-2026-107271GHSA-hxwc-4ggw-27w5

Gophish Login Rate Limit Bypass via X-Forwarded-For Spoofing

Priority HIGH 70CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Gophish through 0.12.1 contains a rate limit bypass that lets unauthenticated attackers evade /login throttling by spoofing the X-Forwarded-For or X-Real-IP header. The limiter is keyed on the rewritten RemoteAddr, so sending a different forwarded address with each request keeps it from triggering, which allows unlimited password guessing and credential stuffing against the login page. CWE-348 (Use of Less Trusted Source) is the weakness, and CVSS 4.0 scores it 6.9 (MEDIUM). A proof-of-concept exploit is referenced, and CISA SSVC rates exploitation as poc, automatable yes, technical impact partial.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gophishgophishup to 0.12.1—No fix listedCNA
  • gophish Vendorgophish Affected up to 0.12.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version and the status is no_fix_listed. Until a fix is available, restrict access to the Gophish login endpoint at the network or reverse-proxy layer, and do not trust X-Forwarded-For or X-Real-IP headers from untrusted clients.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107271
  2. 2026-10-07 Alias added: GHSA-hxwc-4ggw-27w5
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 3

  • TI-2026-56734 Gophish Account Lockout and Forced Password Change Bypassable via API Key CVSS 4.0HIGH 8.6
  • TI-2026-69197 Gophish API lets users take over other users' objects CVSS 4.0HIGH 7.1
  • TI-2026-28778 Gophish 0.12.1 Denial of Service via Office Document Upload CVSS 4.0HIGH 7.1
  • TI-2026-69190 Username enumeration via login timing discrepancy in Gophish CVSS 4.0MEDIUM 6.3
  • TI-2026-69200 Gophish SSRF via POST /api/import/site CVSS 4.0MEDIUM 5.3
  • TI-2026-69199 Cross-site scripting in Gophish via SMTP server error messages CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences