CVE-2026-108522 Details
Description
A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."
An authentication bypass vulnerability has been identified in Studio-Saelix Sencho versions through 0.94.1. The issue arises in the login endpoint, where the application improperly validates the X-Forwarded-For header. This flaw allows remote attackers to manipulate their apparent IP address, bypassing rate limits and facilitating brute-force attacks on user accounts, including administrative accounts.
Users are advised to update to the latest version of Studio-Saelix Sencho, where this vulnerability has been addressed. The patched version no longer trusts X-Forwarded-For headers from unverified proxies and implements a separate rate limit based on account identity.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a | [email protected] | ExploitTechnical Description |
| https://github.com/Studio-Saelix/sencho/ | [email protected] | ProductSource CodeVendor |
| https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72 | [email protected] | Source CodeVendor |
| https://github.com/Studio-Saelix/sencho/pull/1877 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-108522 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/893366 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416188 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416188/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Studio-Saelix Sencho | <= 0.94.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |