CVE-2026-69183

Name of the Vulnerable Software and Affected Versions Monkeytype versions prior to 26.26.1

Description The backend rate-limit key generator in backend/src/middlewares/rate-limit.ts prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate these headers to bypass rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This allows for repeated requests to the POST /users/forgotPasswordEmail and verificationEmail endpoints, which can lead to mail bombing registered users, consumption of Firebase or SMTP quotas, evasion of brute-force protection, and resource exhaustion. The exploitability of cf-connecting-ip depends on the deployment topology, while x-forwarded-for and direct-to-origin paths are affected if these values are not overwritten by a trusted proxy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.