CVE-2026-108522
HighCVSS 8.3Summary
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1 affecting the file /api/auth/login of the Login Endpoint component. Manipulation of the X-Forwarded-For argument results in improper authentication, and the attack can be carried out remotely. The exploit has been made public and could be used; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.
Risk Assessment
An attacker can bypass login attempt limits by rotating the X-Forwarded-For header, enabling brute-force attacks against accounts and potential account takeover.
Recommendation
Deploy patch 79b86ddcd4aefdd6941f098e35990ab397b13c72, which ignores forwarding headers by default and accepts them only from explicitly configured proxy CIDRs.
Other vulnerabilities in Studio-Saelix Sencho
See all- CVE-2026-108523Medium
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1 affecting unknown code of the file outboundTarget.ts of the git-sources Browse API Endpoint component. Manipulation of the repo_url argument can lead to server-side request forgery, and the attack may be performed remotely. The exploit has been publicly disclosed and may be utilized; the patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72.
- CVE-2026-108521Medium
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1 affecting the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the Add Remote Node API Endpoint component. Manipulation leads to server-side request forgery, and the attack can be executed remotely. The exploit has been disclosed to the public and may be used; the vendor confirms that the node API URL could be configured by an authenticated user with node-management permission.
Original NVD description (English source)
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS