EUVD-2026-94402
GHSA-hxwc-4ggw-27w5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated header spoofing with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is limited to disabling a brute-force control (C:L, no direct I/A impact).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
AnalysisAI
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.12.1 are enabled by a login rate-limit bypass: the throttling middleware keys its counter on a client address that is rewritten from the attacker-supplied X-Forwarded-For or X-Real-IP header, so an unauthenticated remote attacker who sends a different forwarded address with every request never trips the limiter. Publicly available exploit code exists (documented in the Ostorlab review and VulnCheck advisory), and the flaw is rated CVSS 4.0 6.9 / assessed CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); it is not confirmed actively exploited, so exploitation depends on whether the /login endpoint is network-reachable and whether targeted accounts use weak, default, or guessable credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Gophish admin login endpoint (/login) be reachable by the attacker (typically an internet-exposed or network-accessible admin interface) and that Gophish be deployed behind a trust model where it honors X-Forwarded-For / X-Real-IP to derive the client IP - which is the default behavior of the vulnerable rate-limit middleware through 0.12.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-severity issue, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, so remediation centers on compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8),
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerab
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phis
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrato
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated m
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated med
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the ser
Same weakness CWE-348 – Use of Less Trusted Source
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today