CVE-2026-78551: RansomLook Auth Bypass Vulnerability

CVE-2026-78551 Overview

CVE-2026-78551 affects RansomLook, an open-source ransomware intelligence platform. The vulnerability combines multiple weaknesses in the /login endpoint that allow an unauthenticated remote attacker to enumerate valid usernames through timing analysis, perform unrestricted password-guessing attacks, and exhaust application worker resources. The issue is classified under [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Critical Impact
A remote unauthenticated attacker can identify valid accounts, mount brute-force or credential-stuffing attacks without throttling, and saturate synchronous Gunicorn workers to cause a full application denial of service.

Affected Products

RansomLook (local authentication path)
Deployments using the shipped Nginx reverse-proxy configuration in etc/nginx/sites-available/ransomlook
RansomLook instances running synchronous Gunicorn workers

Discovery Timeline

2026-08-24 - CVE-2026-78551 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78551

Vulnerability Analysis

The RansomLook local authentication flow contains three compounding weaknesses. First, the login handler checks whether the submitted username exists before invoking the password hash verification routine. Requests for nonexistent usernames return significantly faster than requests for valid accounts. An attacker can measure these response-time differences to enumerate valid usernames.

Second, the /login endpoint applies no rate limiting or lockout on failed authentication attempts. This exposes accounts to brute-force, dictionary, password-spraying, and credential-stuffing attacks at unrestricted speed.

Third, each authentication attempt against a valid username invokes a computationally expensive password key-derivation function. A high rate of login requests occupies the synchronous Gunicorn workers and produces a denial of service across the entire application.

Root Cause

The root cause is a username-dependent code path in the authentication routine combined with the absence of authentication throttling. The reverse-proxy configuration compounded the problem: the previous Nginx configuration used the header X_FORWARDED_PROTO, but Nginx drops underscores in header names by default, so the value never reached the application. A client-supplied X-Forwarded-For header could therefore influence the address seen by the application, defeating any IP-based rate-limiting attempt.

Attack Vector

Exploitation requires only network access to the login endpoint. An attacker times responses to enumerate accounts, then submits high-volume credential guesses against valid usernames. The same requests trigger the expensive key-derivation function on every attempt, saturating worker processes.

text

         proxy_set_header Host $http_host;
         proxy_redirect off;
         proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X_FORWARDED_PROTO $scheme;
+        # Appends the real client address at the end of the chain. ProxyFix is
+        # configured with x_for=1, so it reads the rightmost entry — the one
+        # written here — and a client-supplied header cannot influence it.
+        # Login rate limiting keys on this address.
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # Underscores in header names are dropped by nginx by default, so the
+        # previous X_FORWARDED_PROTO never reached the application.
+        proxy_set_header X-Forwarded-Proto $scheme;
         proxy_connect_timeout 300;
         proxy_read_timeout 300;
         proxy_pass http://localhost:8000/;

Source: RansomLook patch commit 8602740

Detection Methods for CVE-2026-78551

Indicators of Compromise

High volumes of POST /login requests from a single client address or narrow address range within a short window.
Measurable and repeated timing differences in login responses correlated with specific usernames.
Sustained CPU saturation on Gunicorn worker processes coinciding with inbound authentication traffic.
Login traffic carrying attacker-controlled X-Forwarded-For headers on unpatched deployments.

Detection Strategies

Alert on failed authentication bursts exceeding a defined per-IP threshold against the RansomLook /login endpoint.
Baseline normal login response-time distributions and flag scripted probing that samples many distinct usernames.
Correlate reverse-proxy access logs with Gunicorn worker CPU metrics to identify authentication-driven resource exhaustion.

Monitoring Recommendations

Ship Nginx access logs and Gunicorn logs to a central analytics platform for query and long-term retention.
Track the Valkey/Redis rate-limit counters introduced by the fix to observe blocked client addresses.
Monitor for HTTP 429 or 403 responses on /login as a signal of active guessing attempts.

How to Mitigate CVE-2026-78551

Immediate Actions Required

Update RansomLook to the version containing commit 8602740 and deploy the revised Nginx site configuration.
Confirm Valkey or Redis is reachable so the per-IP rate limiter can enforce the five-failures-in-five-minutes threshold with a one-hour block.
Rotate credentials for any accounts that may have been targeted before the patch was applied.
Review authentication logs for evidence of prior enumeration or brute-force activity.

Patch Information

The fix always performs password verification against a randomly generated dummy hash when the supplied username does not exist, removing the username-dependent timing discrepancy. Failed authentication attempts are rate-limited per client IP address using Valkey/Redis. The Nginx configuration was updated so the application derives the client address from a trusted X-Forwarded-For value that a client-supplied header cannot override. See the RansomLook patch commit.

Workarounds

Place the /login endpoint behind an authenticated reverse proxy, VPN, or IP allow-list until the patch is applied.
Enforce rate limiting at the reverse proxy using Nginx limit_req_zone keyed on $binary_remote_addr for the login path.
Disable local authentication temporarily where an external identity provider is available.

bash

# Nginx rate-limit workaround for the login endpoint
limit_req_zone $binary_remote_addr zone=ransomlook_login:10m rate=5r/m;

server {
    location = /login {
        limit_req zone=ransomlook_login burst=5 nodelay;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://localhost:8000/login;
    }
}