A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. (CVE-2026-108522)

The vulnerability in Studio-Saelix Sencho (up to 0.94.1) resides in the login endpoint where the login limiter relied on client-supplied X-Forwarded-For headers without enforcing a trusted-proxy boundary. This allowed attackers to manipulate the X-Forwarded-For header to rotate the apparent client IP address, bypassing authentication limits. The vendor's remediation involves ignoring forwarding headers by default, accepting them only from explicitly configured proxy CIDRs, and implementing a separate failed-attempt limit keyed by normalized account identity. The vulnerability has a CVSS 3.1 score of 8.3, indicating high severity, and the exploit has been publicly disclosed. The patch is identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72.

The vulnerability allows remote attackers to bypass authentication rate limiting by manipulating the X-Forwarded-For header, potentially enabling brute force or credential stuffing attacks. This can lead to unauthorized access (confidentiality impact), modification of data (integrity impact), and denial of service (availability impact). The CVSS score of 8.3 reflects these combined impacts.

A patch is available and should be deployed. The vendor's fix ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity. Applying this patch effectively mitigates the vulnerability.