CVE-2026-126937

Name of the Vulnerable Software and Affected Versions Zipline versions prior to 4.6.5

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists, which occurs when a program checks the state of a resource but the state changes before the program uses the resource. This issue is present in the 'POST /api/setup' endpoint and allows unauthenticated attackers to create multiple SUPERADMIN accounts by sending concurrent requests before the firstSetup flag is reset. Attackers can utilize spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.

Recommendations Update Zipline to version 4.6.5 or later.