Skip to main content

HedgeDoc CVE-2026-58488

MEDIUM
Authentication Bypass by Spoofing (CWE-290)
2026-07-13 GitHub_M
Authentication Bypass Hedgedoc
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable with no auth or complexity required (AV:N/AC:L/PR:N/UI:N); limited integrity impact from mass account creation and limited availability impact from request flooding; no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 13, 2026 - 22:31 vuln.today

DescriptionCVE.org

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used that instead of the users real IP address, if the header was present even when the request did not originate from Cloudflare. This made it possible for an attacker to spam login requests or create multiple arbitrary accounts by sending another cf-connecting-ip header every few requests. The issue has been fixed in version 1.11.0.

AnalysisAI

Rate-limiting bypass in HedgeDoc prior to 1.11.0 permits unauthenticated remote attackers to circumvent brute-force protections on the /login and /register endpoints by injecting arbitrary cf-connecting-ip headers, cycling apparent source IPs per request. This enables unlimited credential-stuffing attacks against login and bulk registration of throwaway accounts. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify internet-facing HedgeDoc instance
Delivery
Craft HTTP request with spoofed cf-connecting-ip header
Exploit
Application accepts header as authoritative client IP
Execution
Rate limiter attributes each request to distinct IP
Persist
Bypass per-IP lockout threshold
Impact
Execute unlimited login or register requests
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must run HedgeDoc on a version prior to 1.11.0 and must be reachable over a network by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N correctly reflects trivial network exploitation with no prerequisites, but the impact sub-scores (VA:L, all others N) understate the practical security consequence for internet-facing deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker scripts HTTP POST requests to a public HedgeDoc instance's /login endpoint, incrementing the cf-connecting-ip header value (e.g., cycling through 1.0.0.1, 1.0.0.2, 1.0.0.3) with each attempt. The application rate limiter records a new unique IP per request and never blocks the attacker's actual source address, permitting thousands of credential-stuffing attempts per minute against known email addresses. …
Remediation Upgrade HedgeDoc to version 1.11.0 or later, which fixes the issue by gating cf-connecting-ip header trust to requests that can be verified as originating from Cloudflare's infrastructure. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hedgedoc

View all
CVE-2020-26287 HIGH POC
8.7 Dec 29

HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 8.7), this vulnerabilit
CVE-2023-38487 HIGH POC
8.2 Aug 04

HedgeDoc is software for creating real-time collaborative markdown notes. Rated high severity (CVSS 8.2), this vulnerabi
CVE-2024-45308 MEDIUM POC
6.5 Sep 02

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.5), this
CVE-2021-21259 MEDIUM POC
6.1 Jan 22

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. Rated medium severity (CV
CVE-2021-29475 CRITICAL
10.0 Apr 26

HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated critical severity (CVSS 10.0)
CVE-2021-29474 MEDIUM POC
5.8 Apr 26

HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. Rated medium severity (CVSS 5.8), t
CVE-2026-58486 HIGH
8.3 Jul 13

Denial of service in HedgeDoc before 1.11.0 lets a user who can store a note crash the instance by embedding a YAML "ali
CVE-2020-26286 HIGH
7.5 Dec 29

HedgeDoc is a collaborative platform for writing and sharing markdown. Rated high severity (CVSS 7.5), this vulnerabilit
CVE-2026-58489 MEDIUM
6.8 Jul 13

HedgeDoc's GitHub Gist export feature exposes private and protected note content to attacker-controlled GitHub accounts

CVE-2025-32391 MEDIUM
6.4 Apr 10

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Rated medium severity (CVSS 6.4), this
CVE-2021-39175 MEDIUM
6.1 Aug 30

HedgeDoc is a platform to write and share markdown. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp
CVE-2021-29503 MEDIUM
6.1 May 19

HedgeDoc is a platform to write and share markdown. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-58488 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy