CVE-2026-33621: Authentication Bypass by Spoofing

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.7.7 through v0.8.4 contain incomplete request-throttling protections for auth-checkable endpoints. In v0.7.7 through v0.8.3, a fully implemented RateLimitMiddleware existed in...

EUVD-2025-32539

Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion...

CVE-2025-59152: Reliance on Untrusted Inputs in a Security Decision

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In version 2.17.0, rate limits can be completely bypassed by manipulating the X-Forwarded-For header. This renders IP-based rate limiting ineffective against determined attackers. Litestar's RateLimitMiddleware uses...