CVE-2026-107271: Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Gophish installations running version 0.12.1 or earlier should be treated as affected. The issue is reachable through the /login endpoint.
What does an attacker need to exploit this issue?
An attacker needs unauthenticated network access to the login endpoint and the ability to send X-Forwarded-For or X-Real-IP headers. They can vary the forwarded address on each request to avoid the rate limiter.
What is the practical impact of successful exploitation?
The login throttling can be bypassed, allowing unlimited password-guessing and credential-stuffing attempts. No valid account or prior authentication is required to perform the bypass.