{"id":"CVE-2026-108522","published":"2026-10-11T04:17:31.737","lastModified":"2026-10-14T03:17:16.023","description":"A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.\"","cvssScore":8.3,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/pull/1877","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108522","tags":[]},{"url":"https://vuldb.com/submit/893366","tags":[]},{"url":"https://vuldb.com/vuln/416188","tags":[]},{"url":"https://vuldb.com/vuln/416188/cti","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72","tags":[]},{"url":"https://github.com/Studio-Saelix/sencho/pull/1877","tags":[]}],"hasPoc":true,"ai":{"summary":"The Studio-Saelix Sencho application has an authentication bypass vulnerability in its login endpoint where the X-Forwarded-For header is improperly trusted, allowing attackers to manipulate their apparent IP address and potentially bypass login rate limiting or authentication controls. This creates a significant risk of unauthorized access to user accounts.","exploitability":"The vulnerability is easily exploitable with no prerequisites as it requires only sending a crafted X-Forwarded-For header in the login request, making it possible for attackers to rotate their apparent client address and bypass authentication protections.","blast_radius":"If exploited, this vulnerability could allow attackers to gain unauthorized access to user accounts through repeated login attempts that appear to come from different IP addresses, potentially leading to account takeover or privilege escalation.","remediation":"Deploy the patch with commit hash 79b86ddcd4aefdd6941f098e35990ab397b13c72 to fix the improper authentication handling in the login endpoint.","detection":"Monitor for unusual patterns in authentication logs showing failed login attempts from multiple IP addresses that appear to be rotating, or check for requests to /api/auth/login with X-Forwarded-For headers that don't match the actual client IP addresses.","tags":["auth-bypass","web","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:07:16.059Z"}}