Threats tagged 'ghsa-3chq-cx7h-2cfx'

Pingvin Share X versions before 1.22.0 have a rate limit bypass vulnerability due to unconditional trust in proxy headers. This allows unauthenticated remote attackers to evade per-IP throttling by spoofing X-Forwarded-For headers. Attackers can exploit this to brute-force passwords and TOTP codes on authentication endpoints and forge logged client IP addresses.