Read the docs
TI-2026-70535 Aliases CVE-2026-108522GHSA-5mq8-98f7-6q76

Sencho Login Endpoint Improper Authentication via X-Forwarded-For

Priority HIGH 70CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Studio-Saelix Sencho up to 0.94.1 (CVE-2026-108522, GHSA-5mq8-98f7-6q76) has improper authentication in the /api/auth/login file of the Login Endpoint component, and manipulating the X-Forwarded-For argument lets a remote attacker bypass the login limiter (CWE-287). The vendor says the limiter trusted client-supplied X-Forwarded-For data without a trusted-proxy boundary, so an attacker could rotate the apparent client address. The exploit has been made public and could be used. CVSS 4.0 base score is 6.9 (MEDIUM), and affected versions 0.94.0 and 0.94.1 have no fix listed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Studio-SaelixSencho0.94.0; 0.94.1—No fix listedCNA
  • Sencho VendorStudio-Saelix Affected 0.94.0; 0.94.1 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Deploy the patch 79b86ddcd4aefdd6941f098e35990ab397b13c72. The patch ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108522
  2. 2026-10-11 Alias added: GHSA-5mq8-98f7-6q76
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-10-14 Priority changed: LOW → HIGH

References

Exploit 1

Patch 2

Other 1

  • TI-2026-70536 Server-side request forgery in Studio-Saelix Sencho Git sources CVSS 4.0MEDIUM 5.3
  • TI-2026-70534 Server-side request forgery in Studio-Saelix Sencho remote nodes CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences