CVE-2026-93650
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Summary
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | Saleor | 3.20.118 | affected |
| n/a | Saleor | 3.21.0 | affected |
| n/a | Saleor | 3.21.1 | affected |
| n/a | Saleor | 3.21.2 | affected |
| n/a | Saleor | 3.21.3 | affected |
| n/a | Saleor | 3.21.4 | affected |
| n/a | Saleor | 3.21.5 | affected |
| n/a | Saleor | 3.21.6 | affected |
| n/a | Saleor | 3.21.7 | affected |
| n/a | Saleor | 3.21.8 | affected |
| n/a | Saleor | 3.21.9 | affected |
| n/a | Saleor | 3.21.10 | affected |
| n/a | Saleor | 3.21.11 | affected |
| n/a | Saleor | 3.21.12 | affected |
| n/a | Saleor | 3.21.13 | affected |
| n/a | Saleor | 3.21.14 | affected |
| n/a | Saleor | 3.21.15 | affected |
| n/a | Saleor | 3.21.16 | affected |
| n/a | Saleor | 3.21.17 | affected |
| n/a | Saleor | 3.21.18 | affected |
| n/a | Saleor | 3.21.19 | affected |
| n/a | Saleor | 3.21.20 | affected |
| n/a | Saleor | 3.21.21 | affected |
| n/a | Saleor | 3.21.22 | affected |
| n/a | Saleor | 3.21.23 | affected |
| n/a | Saleor | 3.21.24 | affected |
| n/a | Saleor | 3.21.25 | affected |
| n/a | Saleor | 3.21.26 | affected |
| n/a | Saleor | 3.21.27 | affected |
| n/a | Saleor | 3.21.28 | affected |
| n/a | Saleor | 3.21.29 | affected |
| n/a | Saleor | 3.21.30 | affected |
| n/a | Saleor | 3.21.31 | affected |
| n/a | Saleor | 3.21.32 | affected |
| n/a | Saleor | 3.21.33 | affected |
| n/a | Saleor | 3.21.34 | affected |
| n/a | Saleor | 3.21.35 | affected |
| n/a | Saleor | 3.21.36 | affected |
| n/a | Saleor | 3.21.37 | affected |
| n/a | Saleor | 3.21.38 | affected |
| n/a | Saleor | 3.21.39 | affected |
| n/a | Saleor | 3.21.40 | affected |
| n/a | Saleor | 3.21.41 | affected |
| n/a | Saleor | 3.21.42 | affected |
| n/a | Saleor | 3.21.43 | affected |
| n/a | Saleor | 3.21.44 | affected |
| n/a | Saleor | 3.21.45 | affected |
| n/a | Saleor | 3.21.46 | affected |
| n/a | Saleor | 3.21.47 | affected |
| n/a | Saleor | 3.21.48 | affected |
| n/a | Saleor | 3.21.49 | affected |
| n/a | Saleor | 3.21.50 | affected |
| n/a | Saleor | 3.21.51 | affected |
| n/a | Saleor | 3.21.52 | affected |
| n/a | Saleor | 3.21.53 | affected |
| n/a | Saleor | 3.21.54 | affected |
| n/a | Saleor | 3.22.0 | affected |
| n/a | Saleor | 3.22.1 | affected |
| n/a | Saleor | 3.22.2 | affected |
| n/a | Saleor | 3.22.3 | affected |
| n/a | Saleor | 3.22.4 | affected |
| n/a | Saleor | 3.22.5 | affected |
| n/a | Saleor | 3.22.6 | affected |
| n/a | Saleor | 3.22.7 | affected |
| n/a | Saleor | 3.22.8 | affected |
| n/a | Saleor | 3.22.9 | affected |
| n/a | Saleor | 3.22.10 | affected |
| n/a | Saleor | 3.22.11 | affected |
| n/a | Saleor | 3.22.12 | affected |
| n/a | Saleor | 3.22.13 | affected |
| n/a | Saleor | 3.22.14 | affected |
| n/a | Saleor | 3.22.15 | affected |
| n/a | Saleor | 3.22.16 | affected |
| n/a | Saleor | 3.22.17 | affected |
| n/a | Saleor | 3.22.18 | affected |
| n/a | Saleor | 3.22.19 | affected |
| n/a | Saleor | 3.22.20 | affected |
| n/a | Saleor | 3.22.21 | affected |
| n/a | Saleor | 3.22.22 | affected |
| n/a | Saleor | 3.22.23 | affected |
| n/a | Saleor | 3.22.24 | affected |
| n/a | Saleor | 3.22.25 | affected |
| n/a | Saleor | 3.22.26 | affected |
| n/a | Saleor | 3.22.27 | affected |
| n/a | Saleor | 3.22.28 | affected |
| n/a | Saleor | 3.22.29 | affected |
| n/a | Saleor | 3.22.30 | affected |
| n/a | Saleor | 3.22.31 | affected |
| n/a | Saleor | 3.22.32 | affected |
| n/a | Saleor | 3.22.33 | affected |
| n/a | Saleor | 3.22.34 | affected |
| n/a | Saleor | 3.22.35 | affected |
| n/a | Saleor | 3.22.36 | affected |
| n/a | Saleor | 3.22.37 | affected |
| n/a | Saleor | 3.22.38 | affected |
| n/a | Saleor | 3.22.39 | affected |
| n/a | Saleor | 3.22.40 | affected |
| n/a | Saleor | 3.22.41 | affected |
| n/a | Saleor | 3.22.42 | affected |
| n/a | Saleor | 3.22.43 | affected |
| n/a | Saleor | 3.22.44 | affected |
| n/a | Saleor | 3.22.45 | affected |
| n/a | Saleor | 3.22.46 | affected |
| n/a | Saleor | 3.22.47 | affected |
| n/a | Saleor | 3.23.0 | affected |
| n/a | Saleor | 3.23.1 | affected |
| n/a | Saleor | 3.23.2 | affected |
| n/a | Saleor | 3.23.3 | affected |
| n/a | Saleor | 3.23.4 | affected |
| n/a | Saleor | 3.23.5 | affected |
| n/a | Saleor | 3.23.6 | affected |
| n/a | Saleor | 3.23.7 | affected |
| n/a | Saleor | 3.23.8 | affected |
| n/a | Saleor | 3.23.9 | affected |
| n/a | Saleor | 3.23.10 | affected |
| n/a | Saleor | 3.23.11 | affected |
| n/a | Saleor | 3.23.12 | affected |
| n/a | Saleor | 3.23.13 | affected |
| n/a | Saleor | 3.23.14 | affected |
Weaknesses
- CWE-307: Improper Restriction of Excessive Authentication Attempts
- CWE-799: Improper Control of Interaction Frequency
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://vuldb.com/vuln/407477
- https://vuldb.com/vuln/407477/cti
- https://vuldb.com/cve/CVE-2026-93650
- https://vuldb.com/submit/933655
- https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md
- https://github.com/saleor/saleor/issues/19203
- https://github.com/saleor/saleor/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.