Threats tagged 'ghsa-v4v4-55gm-p3cp'

PipesHub versions prior to 0.10.0 have a vulnerability in the getClientIp() function that allows unauthenticated attackers to bypass rate limiting by spoofing the X-Forwarded-For or X-Real-IP headers. This enables attackers to evade per-IP throttling on authentication endpoints, facilitating password spraying and flooding of OTP or password-reset emails.