Rate Limit Bypass Vulnerability in PipesHub by PipesHub.ai

CVE-2026-119711

What is CVE-2026-119711?

PipesHub, prior to version 0.10.0, contains a vulnerability that allows attackers to bypass rate limiting mechanisms on authentication endpoints. By spoofing the 'X-Forwarded-For' or 'X-Real-IP' headers, unauthorized users can manipulate their perceived IP address, thereby evading per-IP throttling. This enables them to conduct attacks such as password spraying and flooding authentication services with OTP or password reset requests, which can significantly compromise system security.

References