CVE-2026-93650
Deferred
Deferred - Pending Action
BaseFortify
Vulnerability report for CVE-2026-93650, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-18
Last updated on: 2026-09-18
Assigner: VulDB
Description
Description
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | Saleor | 3.20.118 |
| n/a | Saleor | 3.21.0 |
| n/a | Saleor | 3.21.1 |
| n/a | Saleor | 3.21.2 |
| n/a | Saleor | 3.21.3 |
| n/a | Saleor | 3.21.4 |
| n/a | Saleor | 3.21.5 |
| n/a | Saleor | 3.21.6 |
| n/a | Saleor | 3.21.7 |
| n/a | Saleor | 3.21.8 |
| n/a | Saleor | 3.21.9 |
| n/a | Saleor | 3.21.10 |
| n/a | Saleor | 3.21.11 |
| n/a | Saleor | 3.21.12 |
| n/a | Saleor | 3.21.13 |
| n/a | Saleor | 3.21.14 |
| n/a | Saleor | 3.21.15 |
| n/a | Saleor | 3.21.16 |
| n/a | Saleor | 3.21.17 |
| n/a | Saleor | 3.21.18 |
| n/a | Saleor | 3.21.19 |
| n/a | Saleor | 3.21.20 |
| n/a | Saleor | 3.21.21 |
| n/a | Saleor | 3.21.22 |
| n/a | Saleor | 3.21.23 |
| n/a | Saleor | 3.21.24 |
| n/a | Saleor | 3.21.25 |
| n/a | Saleor | 3.21.26 |
| n/a | Saleor | 3.21.27 |
| n/a | Saleor | 3.21.28 |
| n/a | Saleor | 3.21.29 |
| n/a | Saleor | 3.21.30 |
| n/a | Saleor | 3.21.31 |
| n/a | Saleor | 3.21.32 |
| n/a | Saleor | 3.21.33 |
| n/a | Saleor | 3.21.34 |
| n/a | Saleor | 3.21.35 |
| n/a | Saleor | 3.21.36 |
| n/a | Saleor | 3.21.37 |
| n/a | Saleor | 3.21.38 |
| n/a | Saleor | 3.21.39 |
| n/a | Saleor | 3.21.40 |
| n/a | Saleor | 3.21.41 |
| n/a | Saleor | 3.21.42 |
| n/a | Saleor | 3.21.43 |
| n/a | Saleor | 3.21.44 |
| n/a | Saleor | 3.21.45 |
| n/a | Saleor | 3.21.46 |
| n/a | Saleor | 3.21.47 |
| n/a | Saleor | 3.21.48 |
| n/a | Saleor | 3.21.49 |
| n/a | Saleor | 3.21.50 |
| n/a | Saleor | 3.21.51 |
| n/a | Saleor | 3.21.52 |
| n/a | Saleor | 3.21.53 |
| n/a | Saleor | 3.21.54 |
| n/a | Saleor | 3.22.0 |
| n/a | Saleor | 3.22.1 |
| n/a | Saleor | 3.22.2 |
| n/a | Saleor | 3.22.3 |
| n/a | Saleor | 3.22.4 |
| n/a | Saleor | 3.22.5 |
| n/a | Saleor | 3.22.6 |
| n/a | Saleor | 3.22.7 |
| n/a | Saleor | 3.22.8 |
| n/a | Saleor | 3.22.9 |
| n/a | Saleor | 3.22.10 |
| n/a | Saleor | 3.22.11 |
| n/a | Saleor | 3.22.12 |
| n/a | Saleor | 3.22.13 |
| n/a | Saleor | 3.22.14 |
| n/a | Saleor | 3.22.15 |
| n/a | Saleor | 3.22.16 |
| n/a | Saleor | 3.22.17 |
| n/a | Saleor | 3.22.18 |
| n/a | Saleor | 3.22.19 |
| n/a | Saleor | 3.22.20 |
| n/a | Saleor | 3.22.21 |
| n/a | Saleor | 3.22.22 |
| n/a | Saleor | 3.22.23 |
| n/a | Saleor | 3.22.24 |
| n/a | Saleor | 3.22.25 |
| n/a | Saleor | 3.22.26 |
| n/a | Saleor | 3.22.27 |
| n/a | Saleor | 3.22.28 |
| n/a | Saleor | 3.22.29 |
| n/a | Saleor | 3.22.30 |
| n/a | Saleor | 3.22.31 |
| n/a | Saleor | 3.22.32 |
| n/a | Saleor | 3.22.33 |
| n/a | Saleor | 3.22.34 |
| n/a | Saleor | 3.22.35 |
| n/a | Saleor | 3.22.36 |
| n/a | Saleor | 3.22.37 |
| n/a | Saleor | 3.22.38 |
| n/a | Saleor | 3.22.39 |
| n/a | Saleor | 3.22.40 |
| n/a | Saleor | 3.22.41 |
| n/a | Saleor | 3.22.42 |
| n/a | Saleor | 3.22.43 |
| n/a | Saleor | 3.22.44 |
| n/a | Saleor | 3.22.45 |
| n/a | Saleor | 3.22.46 |
| n/a | Saleor | 3.22.47 |
| n/a | Saleor | 3.23.0 |
| n/a | Saleor | 3.23.1 |
| n/a | Saleor | 3.23.2 |
| n/a | Saleor | 3.23.3 |
| n/a | Saleor | 3.23.4 |
| n/a | Saleor | 3.23.5 |
| n/a | Saleor | 3.23.6 |
| n/a | Saleor | 3.23.7 |
| n/a | Saleor | 3.23.8 |
| n/a | Saleor | 3.23.9 |
| n/a | Saleor | 3.23.10 |
| n/a | Saleor | 3.23.11 |
| n/a | Saleor | 3.23.12 |
| n/a | Saleor | 3.23.13 |
| n/a | Saleor | 3.23.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-799 | The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests. |
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
