CVE-2026-119711

Name of the Vulnerable Software and Affected Versions PipesHub versions prior to 0.10.0

Description A rate limit bypass exists in the getClientIp() function. Unauthenticated attackers can evade per-IP throttling by spoofing the X-Forwarded-For or X-Real-IP headers. By rotating these header values, attackers can obtain fresh rate-limit buckets on authentication endpoints, which facilitates password spraying and the flooding of OTP or password-reset emails.

Recommendations Update PipesHub to version 0.10.0 or later. As a temporary workaround, restrict or validate the X-Forwarded-For and X-Real-IP headers at the network edge or load balancer to prevent spoofing.