Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

Advisories

Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

severity: medium
date: 10/7/2026
Affecting: gophish <= 0.12.1
CVE: CVE-2026-107271
CWE: CWE-348 Use of Less Trusted Source
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: Researcher Disclosure
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/route.go#L168
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/middleware/ratelimit/ratelimit.go#L132-L136
https://github.com/gophish/gophish
VulnCheck Advisory: Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Credit: Sohaib Harraoui (Ostorlab)
Description: Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo