CVE-2026-93650

Summary

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".

Affected Software

VendorProductVersion RangeStatus
n/aSaleor3.20.118affected
n/aSaleor3.21.0affected
n/aSaleor3.21.1affected
n/aSaleor3.21.2affected
n/aSaleor3.21.3affected
n/aSaleor3.21.4affected
n/aSaleor3.21.5affected
n/aSaleor3.21.6affected
n/aSaleor3.21.7affected
n/aSaleor3.21.8affected
n/aSaleor3.21.9affected
n/aSaleor3.21.10affected
n/aSaleor3.21.11affected
n/aSaleor3.21.12affected
n/aSaleor3.21.13affected
n/aSaleor3.21.14affected
n/aSaleor3.21.15affected
n/aSaleor3.21.16affected
n/aSaleor3.21.17affected
n/aSaleor3.21.18affected
n/aSaleor3.21.19affected
n/aSaleor3.21.20affected
n/aSaleor3.21.21affected
n/aSaleor3.21.22affected
n/aSaleor3.21.23affected
n/aSaleor3.21.24affected
n/aSaleor3.21.25affected
n/aSaleor3.21.26affected
n/aSaleor3.21.27affected
n/aSaleor3.21.28affected
n/aSaleor3.21.29affected
n/aSaleor3.21.30affected
n/aSaleor3.21.31affected
n/aSaleor3.21.32affected
n/aSaleor3.21.33affected
n/aSaleor3.21.34affected
n/aSaleor3.21.35affected
n/aSaleor3.21.36affected
n/aSaleor3.21.37affected
n/aSaleor3.21.38affected
n/aSaleor3.21.39affected
n/aSaleor3.21.40affected
n/aSaleor3.21.41affected
n/aSaleor3.21.42affected
n/aSaleor3.21.43affected
n/aSaleor3.21.44affected
n/aSaleor3.21.45affected
n/aSaleor3.21.46affected
n/aSaleor3.21.47affected
n/aSaleor3.21.48affected
n/aSaleor3.21.49affected
n/aSaleor3.21.50affected
n/aSaleor3.21.51affected
n/aSaleor3.21.52affected
n/aSaleor3.21.53affected
n/aSaleor3.21.54affected
n/aSaleor3.22.0affected
n/aSaleor3.22.1affected
n/aSaleor3.22.2affected
n/aSaleor3.22.3affected
n/aSaleor3.22.4affected
n/aSaleor3.22.5affected
n/aSaleor3.22.6affected
n/aSaleor3.22.7affected
n/aSaleor3.22.8affected
n/aSaleor3.22.9affected
n/aSaleor3.22.10affected
n/aSaleor3.22.11affected
n/aSaleor3.22.12affected
n/aSaleor3.22.13affected
n/aSaleor3.22.14affected
n/aSaleor3.22.15affected
n/aSaleor3.22.16affected
n/aSaleor3.22.17affected
n/aSaleor3.22.18affected
n/aSaleor3.22.19affected
n/aSaleor3.22.20affected
n/aSaleor3.22.21affected
n/aSaleor3.22.22affected
n/aSaleor3.22.23affected
n/aSaleor3.22.24affected
n/aSaleor3.22.25affected
n/aSaleor3.22.26affected
n/aSaleor3.22.27affected
n/aSaleor3.22.28affected
n/aSaleor3.22.29affected
n/aSaleor3.22.30affected
n/aSaleor3.22.31affected
n/aSaleor3.22.32affected
n/aSaleor3.22.33affected
n/aSaleor3.22.34affected
n/aSaleor3.22.35affected
n/aSaleor3.22.36affected
n/aSaleor3.22.37affected
n/aSaleor3.22.38affected
n/aSaleor3.22.39affected
n/aSaleor3.22.40affected
n/aSaleor3.22.41affected
n/aSaleor3.22.42affected
n/aSaleor3.22.43affected
n/aSaleor3.22.44affected
n/aSaleor3.22.45affected
n/aSaleor3.22.46affected
n/aSaleor3.22.47affected
n/aSaleor3.23.0affected
n/aSaleor3.23.1affected
n/aSaleor3.23.2affected
n/aSaleor3.23.3affected
n/aSaleor3.23.4affected
n/aSaleor3.23.5affected
n/aSaleor3.23.6affected
n/aSaleor3.23.7affected
n/aSaleor3.23.8affected
n/aSaleor3.23.9affected
n/aSaleor3.23.10affected
n/aSaleor3.23.11affected
n/aSaleor3.23.12affected
n/aSaleor3.23.13affected
n/aSaleor3.23.14affected

Weaknesses

  • CWE-307: Improper Restriction of Excessive Authentication Attempts
  • CWE-799: Improper Control of Interaction Frequency

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References