Backend Rate Limiting Bypass in Monkeytype by Monkeytype

CVE-2026-69183

What is CVE-2026-69183?

Monkeytype, a customizable typing test application, has a critical vulnerability in its backend rate-limit key generator. Versions prior to 26.26.0 improperly use client-controlled headers, allowing unauthenticated attackers to manipulate these headers to create separate buckets for each request. As a result, attackers can bypass various rate limiting mechanisms, including the rootRateLimiter and badAuthRateLimiter. This vulnerability permits repeated requests to certain public endpoints, enabling mail bombing of user accounts, consuming Firebase or SMTP quotas, and evading brute-force protections, with the potential for significant resource exhaustion. The impact may vary based on deployment architecture, especially concerning the cf-connecting-ip value, while the x-forwarded-for header remains vulnerable when not controlled by a trusted proxy. Currently, no fixed version has been released for this issue.

References