Rate Limit Bypass Vulnerability in Zipline by Diced

CVE-2026-126934

What is CVE-2026-126934?

Zipline versions 4.3.2 through 4.7.x are susceptible to a rate limit bypass vulnerability. This issue enables unauthenticated attackers to exploit the core.trustProxy feature by spoofing X-Forwarded-For headers. As a result, attackers can send varying X-Forwarded-For values with each request, effectively evading throttling mechanisms. This leads to the potential for unlimited guessing attempts against login passwords, TOTP codes, and both file and URL passwords, significantly undermining the application's security.

References