3.7

CVE-2026-93650

Exploit

Saleor throttling.py get_client_ip excessive authentication

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt Saleor
Version 3.20.118
Status affected
Version 3.21.0
Status affected
Version 3.21.1
Status affected
Version 3.21.2
Status affected
Version 3.21.3
Status affected
Version 3.21.4
Status affected
Version 3.21.5
Status affected
Version 3.21.6
Status affected
Version 3.21.7
Status affected
Version 3.21.8
Status affected
Version 3.21.9
Status affected
Version 3.21.10
Status affected
Version 3.21.11
Status affected
Version 3.21.12
Status affected
Version 3.21.13
Status affected
Version 3.21.14
Status affected
Version 3.21.15
Status affected
Version 3.21.16
Status affected
Version 3.21.17
Status affected
Version 3.21.18
Status affected
Version 3.21.19
Status affected
Version 3.21.20
Status affected
Version 3.21.21
Status affected
Version 3.21.22
Status affected
Version 3.21.23
Status affected
Version 3.21.24
Status affected
Version 3.21.25
Status affected
Version 3.21.26
Status affected
Version 3.21.27
Status affected
Version 3.21.28
Status affected
Version 3.21.29
Status affected
Version 3.21.30
Status affected
Version 3.21.31
Status affected
Version 3.21.32
Status affected
Version 3.21.33
Status affected
Version 3.21.34
Status affected
Version 3.21.35
Status affected
Version 3.21.36
Status affected
Version 3.21.37
Status affected
Version 3.21.38
Status affected
Version 3.21.39
Status affected
Version 3.21.40
Status affected
Version 3.21.41
Status affected
Version 3.21.42
Status affected
Version 3.21.43
Status affected
Version 3.21.44
Status affected
Version 3.21.45
Status affected
Version 3.21.46
Status affected
Version 3.21.47
Status affected
Version 3.21.48
Status affected
Version 3.21.49
Status affected
Version 3.21.50
Status affected
Version 3.21.51
Status affected
Version 3.21.52
Status affected
Version 3.21.53
Status affected
Version 3.21.54
Status affected
Version 3.22.0
Status affected
Version 3.22.1
Status affected
Version 3.22.2
Status affected
Version 3.22.3
Status affected
Version 3.22.4
Status affected
Version 3.22.5
Status affected
Version 3.22.6
Status affected
Version 3.22.7
Status affected
Version 3.22.8
Status affected
Version 3.22.9
Status affected
Version 3.22.10
Status affected
Version 3.22.11
Status affected
Version 3.22.12
Status affected
Version 3.22.13
Status affected
Version 3.22.14
Status affected
Version 3.22.15
Status affected
Version 3.22.16
Status affected
Version 3.22.17
Status affected
Version 3.22.18
Status affected
Version 3.22.19
Status affected
Version 3.22.20
Status affected
Version 3.22.21
Status affected
Version 3.22.22
Status affected
Version 3.22.23
Status affected
Version 3.22.24
Status affected
Version 3.22.25
Status affected
Version 3.22.26
Status affected
Version 3.22.27
Status affected
Version 3.22.28
Status affected
Version 3.22.29
Status affected
Version 3.22.30
Status affected
Version 3.22.31
Status affected
Version 3.22.32
Status affected
Version 3.22.33
Status affected
Version 3.22.34
Status affected
Version 3.22.35
Status affected
Version 3.22.36
Status affected
Version 3.22.37
Status affected
Version 3.22.38
Status affected
Version 3.22.39
Status affected
Version 3.22.40
Status affected
Version 3.22.41
Status affected
Version 3.22.42
Status affected
Version 3.22.43
Status affected
Version 3.22.44
Status affected
Version 3.22.45
Status affected
Version 3.22.46
Status affected
Version 3.22.47
Status affected
Version 3.23.0
Status affected
Version 3.23.1
Status affected
Version 3.23.2
Status affected
Version 3.23.3
Status affected
Version 3.23.4
Status affected
Version 3.23.5
Status affected
Version 3.23.6
Status affected
Version 3.23.7
Status affected
Version 3.23.8
Status affected
Version 3.23.9
Status affected
Version 3.23.10
Status affected
Version 3.23.11
Status affected
Version 3.23.12
Status affected
Version 3.23.13
Status affected
Version 3.23.14
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.451
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@vuldb.com 2.9 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 3.7 2.2 1.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cna@vuldb.com 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:P/I:N/A:N
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

CWE-799 Improper Control of Interaction Frequency

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

https://vuldb.com/vuln/407477
https://vuldb.com/vuln/407477/cti
https://vuldb.com/cve/CVE-2026-93650
https://vuldb.com/submit/933655
https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md
https://github.com/saleor/saleor/issues/19203
https://github.com/saleor/saleor/