CVE-2026-93650

Saleor throttling.py get_client_ip excessive authentication

State: Published
Severity: 6.3 Medium
Published: Sep 18, 2026
Updated: Sep 18, 2026
Reserved: Sep 18, 2026

Description

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-799 Improper Control of Interaction Frequency

Affected Products

Product	Versions
Saleorn/a	3.20.118Affected 3.21.0Affected 3.21.1Affected 3.21.2Affected 3.21.3Affected 3.21.4Affected 3.21.5Affected 3.21.6Affected 3.21.7Affected 3.21.8Affected 3.21.9Affected 3.21.10Affected 3.21.11Affected 3.21.12Affected 3.21.13Affected 3.21.14Affected 3.21.15Affected 3.21.16Affected 3.21.17Affected 3.21.18Affected 3.21.19Affected 3.21.20Affected 3.21.21Affected 3.21.22Affected 3.21.23Affected and 94 more versions

Product

Versions

Saleorn/a

3.20.118Affected
3.21.0Affected
3.21.1Affected
3.21.2Affected
3.21.3Affected
3.21.4Affected
3.21.5Affected
3.21.6Affected
3.21.7Affected
3.21.8Affected
3.21.9Affected
3.21.10Affected
3.21.11Affected
3.21.12Affected
3.21.13Affected
3.21.14Affected
3.21.15Affected
3.21.16Affected
3.21.17Affected
3.21.18Affected
3.21.19Affected
3.21.20Affected
3.21.21Affected
3.21.22Affected
3.21.23Affected
and 94 more versions

References

VDB-407477 | Saleor throttling.py get_client_ip excessive authenticationvdb-entrytechnical-description
VDB-407477 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-93650 | CVE Analysis and Reportthird-party-advisory
Submit #933655 | saleor <=3.23.14 Improper Restriction of Excessive Authentication Attemptsthird-party-advisory
https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.mdexploit
https://github.com/saleor/saleor/issues/19203issue-tracking
https://github.com/saleor/saleor/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.