CVE-2026-93650 Overview
CVE-2026-93650 affects Saleor versions up to 3.20.118, 3.21.54, 3.22.47, and 3.23.14. The vulnerability resides in the get_client_ip function in saleor/account/throttling.py. Attackers can manipulate client IP resolution to bypass authentication throttling, enabling brute-force attempts against accounts. The flaw is categorized as improper restriction of excessive authentication attempts [CWE-307].
The project's own issue #19203 acknowledges that "IP can be spoofed in most deployments" and that the REAL_IP_ENVIRON-type setting bypasses get_client_ip. A proposed fix using right-to-left RFC 7239 hop selection remains unmerged. The vendor has stated via email that this behavior is intended, and that Saleor expects the X-Forwarded-For (XFF) header to be configured properly by the deployer.
Critical Impact
Authentication throttling can be bypassed via spoofed client IP headers, permitting distributed brute-force attempts against Saleor account endpoints.
Affected Products
- Saleor versions up to and including 3.20.118
- Saleor versions up to and including 3.21.54
- Saleor versions up to and including 3.22.47 and 3.23.14
Discovery Timeline
- 2026-09-18 - CVE-2026-93650 published to NVD
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-93650
Vulnerability Analysis
Saleor's authentication throttling relies on get_client_ip in saleor/account/throttling.py to identify the source of authentication attempts. The function derives the client address from HTTP headers such as X-Forwarded-For without validating hop provenance. Attackers who control these headers can rotate values across requests, presenting each attempt as originating from a unique IP.
The throttling logic then keys its rate-limit counters against attacker-supplied values. Each spoofed IP receives its own attempt budget, defeating the excessive-authentication-attempt control. The result is unbounded credential guessing against the login and password-reset flows, subject to the attack complexity noted for this issue.
Exploitability is described as difficult. The attack requires a deployment where the WSGI/ASGI front end forwards untrusted header values without normalization, or where operators have enabled REAL_IP_ENVIRON-style settings that bypass get_client_ip entirely. The exploit has been publicly disclosed.
Root Cause
The root cause is trust in client-controlled X-Forwarded-For values during throttle-key derivation. get_client_ip does not perform right-to-left RFC 7239 hop selection, so it cannot distinguish trusted proxy hops from attacker-injected addresses. Additionally, the REAL_IP_ENVIRON code path circumvents get_client_ip altogether, removing throttling for affected deployments.
Attack Vector
The attack is executed remotely over the network without authentication or user interaction. An attacker sends repeated authentication requests to a Saleor instance while varying the X-Forwarded-For header on each request. Because the throttle counter is bucketed per spoofed IP, the attacker sustains a brute-force campaign against a single account without triggering lockouts.
Verified proof-of-concept code is not published in the enriched data. See the Zast AI Bruteforce Report and GitHub Saleor Issue #19203 for technical detail.
Detection Methods for CVE-2026-93650
Indicators of Compromise
- High volume of authentication requests to Saleor endpoints where each request carries a distinct X-Forwarded-For value but originates from a narrow set of TCP sources.
- Repeated failed logins for the same username across many claimed client IPs within short time windows.
- Presence of X-Forwarded-For chains containing private, reserved, or malformed addresses reaching the Saleor application layer.
Detection Strategies
- Correlate the true TCP source IP at the edge proxy with the X-Forwarded-For value observed by the Saleor application to identify header spoofing.
- Alert on authentication failure rates per account and per true source IP rather than per header-derived IP.
- Review Saleor configuration for REAL_IP_ENVIRON-type settings that bypass get_client_ip.
Monitoring Recommendations
- Ingest reverse proxy and Saleor application logs into a centralized analytics platform for join analysis on connection metadata versus header values.
- Track EPSS movement for CVE-2026-93650, currently reported at 0.689% (percentile 50.7).
- Monitor the GitHub Saleor Issue #19203 for merge status of the RFC 7239 hop-selection fix.
How to Mitigate CVE-2026-93650
Immediate Actions Required
- Configure the edge proxy or load balancer to overwrite, not append to, the X-Forwarded-For header so only trusted hops reach Saleor.
- Disable REAL_IP_ENVIRON-type settings that bypass get_client_ip throttling.
- Add web application firewall rules that rate-limit authentication endpoints by true TCP source and by target username.
Patch Information
No merged upstream patch is available at time of publication. A right-to-left RFC 7239 hop-selection fix has been proposed in GitHub Saleor Issue #19203 but remains unmerged. The vendor position, communicated via email, is that the behavior is working as intended and that operators are expected to configure XFF correctly. Track the GitHub Saleor Repository for future releases addressing this issue.
Workarounds
- Terminate TLS at a trusted reverse proxy that strips inbound X-Forwarded-For values and sets a single trusted hop before forwarding to Saleor.
- Enforce account-level lockout policies that count failed attempts per username regardless of source IP.
- Deploy multi-factor authentication on Saleor staff and customer accounts to reduce the value of successful credential guessing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.