CVE-2026-11922 is an authentication bypass vulnerability in zenml-io/zenml (versions 0.57.0 to 0.94.2) that allows attackers to circumvent rate-limiting protections on the POST /api/v1/login and self password-change endpoints. The issue arises because the rate limiter keys requests based on request.client.host, which is derived from the X-Forwarded-For header when Uvicorn is launched with the --proxy-headers and --forwarded-allow-ips * options. Since clients can control the X-Forwarded-For header, they can rotate the client IP value and bypass rate limits, enabling unthrottled credential guessing attacks. No known exploits in the wild have been reported, and no official fix or patch is documented.

The vulnerability allows attackers to bypass rate-limiting on authentication-related endpoints by spoofing the client IP address via the X-Forwarded-For header. This can lead to unthrottled credential guessing attacks, increasing the risk of unauthorized access through brute force or password guessing. The confidentiality and integrity of user accounts are at risk, but availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the --proxy-headers and --forwarded-allow-ips * options in Uvicorn to prevent clients from controlling the client IP used for rate limiting. Additionally, implementing alternative rate-limiting strategies that do not rely solely on the X-Forwarded-For header or client IP may help mitigate this issue.