Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing… (CVE-2026-107271)

Gophish up to version 0.12.1 contains a vulnerability (CVE-2026-107271) where unauthenticated attackers can bypass login rate limiting by spoofing the X-Forwarded-For or X-Real-IP HTTP headers. The rate limiter relies on the RemoteAddr value, which can be manipulated by sending different forwarded addresses per request, preventing the limiter from triggering. This flaw allows unlimited login attempts, facilitating password guessing and credential stuffing attacks.

The vulnerability allows attackers to bypass login throttling, increasing the risk of successful password guessing and credential stuffing attacks. This can lead to unauthorized access to user accounts with low to medium confidentiality impact. The CVSS score is 5.3 (medium severity), indicating limited confidentiality impact and no integrity or availability impact.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional protections such as external rate limiting or blocking suspicious header spoofing at the network perimeter.