CVE-2026-93650: Saleor throttling.py get_client_ip excessive authentication
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function getclientip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REALIPENVIRON-type setting bypasses getclientip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Affected Software
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Deployments where X-Forwarded-For is not configured properly are the stated concern. The project issue notes that IP addresses can be spoofed in most deployments, and the vendor says Saleor expects XFF to be configured correctly.
What does an attacker need to exploit this issue?
The attack can be performed remotely without privileges or user interaction, but it requires high complexity and is described as difficult to exploit. A public exploit has been disclosed and may be used.
Does the REAL_IP_ENVIRON setting avoid the affected code path?
Yes. The issue states that the REAL_IP_ENVIRON-type setting bypasses get_client_ip, so it does not use the affected client-IP determination function.
What can be done if an update is not available?
Ensure X-Forwarded-For is configured properly in the deployment path. The proposed remediation described in the issue is right-to-left RFC 7239 hop selection, but it is stated to be unmerged.