PipesHub EUVD-2026-114116

No special conditions for the bypass itself - remote, unauthenticated exploitation works against default PipesHub deployments (<=0.9.1), because the code trusts the client-supplied X-Forwarded-For/X-Real-IP header verbatim and there is no 'trust proxy' configuration; the affected auth and unauthenticated OAuth endpoints (/authenticate, /login/otp/generate, /password/forgot, /oauth2/token, /oauth2/introspect, /oauth2/revoke) have no dedicated limiter beyond the bypassable global one. The limiting factor is impact scope: the bypass alone only removes throttling - turning it into account takeover additionally requires guessing a valid password or OTP (aided by the six-digit OTP space and reported lack of account lockout), and the email-bombing impact depends on the password-reset endpoint accepting arbitrary addresses. Deployments that already sit behind a properly configured trusted reverse proxy (and, post-fix, set TRUST_PROXY to a specific hop count or CIDR rather than 'true') are not exposed in the same way.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bypass is reachable remotely, without authentication, without user interaction, and with low attack complexity - so the control is trivially defeated. However, the impact metrics are deliberately narrow (VC:N/VI:L/VA:N): the flaw itself discloses nothing and does not directly compromise the system; it removes the brake that makes credential/OTP brute force and email flooding impractical. Real severity therefore depends on chaining: on its own it is a weakened-control (CWE-348/CWE-307) issue scored 6.9, but combined with a successful password spray or OTP guess (six-digit space, no account lockout per the report) it becomes a practical account-takeover path. No EPSS score and no CISA KEV listing were provided, and the vendor/VulnCheck make no active-exploitation claim, so there is no signal of widespread opportunistic exploitation. The vuln.today priority is 'this_month' (not act_now/emergency), consistent with a patch-promptly-but-not-drop-everything posture. One nuance to verify: the vector is AV:N/PR:N because the bypass is unauthenticated, but the headline consequence (account takeover) is only realized when the attacker also guesses a valid credential or OTP, which the base vector does not capture.

An unauthenticated attacker targets the exposed PipesHub authentication endpoints (e.g. /api/v1/userAccount/authenticate, /login/otp/generate, /password/forgot) and sends each request with a different spoofed X-Forwarded-For (or X-Real-IP) header, so the per-IP limiter assigns a fresh bucket every time and never throttles. They then run an unlimited password-spray or OTP brute-force campaign, or flood arbitrary addresses with password-reset emails from the product's own mail infrastructure. The GHSA/VulnCheck advisory includes an executed curl/Burp reproduction with observed results (60 requests throttled with a fixed header; 0 of 90 throttled with the header rotated).