CVE-2026-69183
Received Received - Intake

Rate Limiting Bypass in Monkeytype via Header Manipulation

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-69183
EUVD
EUVD-2026-63423

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
monkeytype monkeytype to 26.26.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-644 The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Monkeytype allows attackers to bypass rate-limiting and anti-brute-force protections by manipulating HTTP headers like cf-connecting-ip and x-forwarded-for. The backend prioritizes these client-controlled headers over the trusted req.ip value, enabling attackers to create a new rate-limit bucket for each request and bypass protections on critical endpoints.

Detection Guidance

Monitor for unusual traffic patterns on endpoints like POST /users/forgotPasswordEmail and verificationEmail. Check for repeated requests from the same IP with varying cf-connecting-ip or x-forwarded-for headers. Inspect logs for excessive email generation attempts or failed login spikes.

Impact Analysis

Attackers can send unlimited password-reset or verification emails to any user, causing mail bombing and exhausting email service quotas. They can also bypass brute-force protection to make unlimited failed login attempts and consume server resources, leading to denial-of-service conditions.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to potential unauthorized access to user accounts via brute-force attacks bypassing rate limits and the ability to send unlimited password reset or verification emails, causing mail bombing and exposing user data. Resource exhaustion from repeated requests may also disrupt service availability, impacting compliance with availability requirements.

Mitigation Strategies

Update the rate-limit key generation in backend/src/middlewares/rate-limit.ts to use req.ip instead of client-controlled headers. Configure Express trust proxy properly and validate proxy headers. Implement per-email or per-user throttling and global quotas for email endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart