Rate Limit Bypass in Gophish Affects Unauthenticated Access
CVE-2026-107271
6.9MEDIUM
What is CVE-2026-107271?
The Gophish product version 0.12.1 is susceptible to a rate limit bypass vulnerability which allows attackers to circumvent login throttling mechanisms. By manipulating the X-Forwarded-For or X-Real-IP headers, attackers can disguise their real IP addresses with each request. This evasion technique perpetuates unlimited login attempts, enabling password guessing and credential stuffing attacks to be executed with ease, significantly threatening the security integrity of affected systems.
Affected Version(s)
gophish 0 <= 0.12.1
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Sohaib Harraoui (Ostorlab)