Monkeytype EUVD-2026-63423

The x-forwarded-for spoofing path requires only network access to any Monkeytype backend HTTP endpoint and is exploitable unconditionally on deployments where no trusted upstream proxy strips or overwrites that header before the request reaches the application. The cf-connecting-ip path is exploitable only on deployments not behind Cloudflare, or where Cloudflare is not configured as the sole source allowed to set that header. No authentication is required. To trigger mail-bombing specifically, the attacker must know at least one registered user's email address; however, the rate-limit bypass itself applies to all public API endpoints regardless of whether a target email is known. Exploitation is constrained to resource exhaustion and brute-force evasion - no direct access to stored user data or credentials is provided by this bypass alone. Deployments correctly configured with trust proxy set exclusively to a verified upstream proxy IP, where that proxy reliably overwrites both headers, are substantially mitigated.

CVSS 3.1 scores this at 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting trivial, unauthenticated network exploitation with high availability impact - an accurate characterization given the zero-complexity header manipulation required. EPSS data is absent from the provided intelligence, so exploitation probability relative to the broader threat landscape cannot be quantified. The vulnerability is not listed in CISA KEV, and no proof-of-concept has been identified at time of analysis, which reduces immediate urgency for patch-cycle prioritization. However, the combination of zero authentication, zero complexity, and no available fix creates a persistently open exposure window for all deployments. The secondary risk of exhausting shared Firebase or SMTP quotas is operationally significant - it can deny email-based account functions (password reset, verification) to all legitimate users, not just the direct target. The brute-force evasion angle is a meaningful multiplier: once rate limiting is bypassed, credential stuffing against registered accounts becomes feasible. Overall this represents a genuine operational risk rather than a theoretical high-CVSS-low-real-risk case.

An unauthenticated attacker who knows a registered user's email address sends a high-volume loop of POST requests to /users/forgotPasswordEmail, incrementing a spoofed x-forwarded-for header value with each request. Because each unique header value produces a distinct rate-limit bucket, no limiter fires and the backend dispatches a password-reset email for every request, flooding the victim's inbox and rapidly depleting the platform's Firebase or SMTP sending quota. Once quota is exhausted, legitimate password reset and email verification functions are denied to all users until quota resets, and the same header-rotation technique can be applied to brute-force login endpoints without triggering lockout.