Zipline Rate Limit Bypass via Query String Manipulation

Executive Summary

CVE-2026-126940 is a rate limit bypass vulnerability in Zipline versions before 4.6.4. Attackers can evade request limits by varying query strings or using the x-zipline-p-filename header. This allows unlimited brute-force attempts on login and password verification endpoints.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual login attempts or file access patterns, particularly with varying query strings or the x-zipline-p-filename header. Check logs for repeated requests to login or password verification endpoints with different parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to perform excessive authentication attempts beyond rate limits. While it doesn't directly bypass authentication, it may expose sensitive information or allow actions under a victim's account through credential guessing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.6.4 or later to patch the vulnerability. Implement additional rate limiting or account lockout mechanisms for login and password verification endpoints.

Useful 0 Not Useful 0