CVE-2026-93650

CVE-2026-93650 affects Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14, specifically the get_client_ip function in saleor/account/throttling.py. The root cause is that client-supplied IP headers (X-Forwarded-For) are trusted, allowing IP spoofing to bypass rate limiting and enable excessive authent...

CVE-2026-93650 Saleor throttling.py get_client_ip excessive authentication

A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function getclientip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed...