CVE-2026-126937: Zipline before 4.6.5 TOCTOU Race Condition via /api/setup
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.
Affected Software
Event History
Frequently Asked Questions
Which instances are exposed to this issue?
Zipline instances running a version before 4.6.5 are affected if the POST /api/setup endpoint can still be reached while initial setup is in progress. The issue concerns the period before the firstSetup flag has been reset.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to send concurrent POST requests to /api/setup during the argon2 password-hashing window, using spoofed X-Forwarded-For headers.
What is the impact of a successful race?
A successful attacker can create one or more SUPERADMIN accounts and obtain full administrative control of the Zipline instance.
How can I determine whether an instance may already have been exploited?
Review SUPERADMIN accounts for unexpected or duplicate accounts, particularly accounts created around the initial setup period. Also review requests to POST /api/setup for concurrent activity and spoofed X-Forwarded-For header values.