CVE-2026-107271: gophish Use of Less Trusted Source

Vulnerability summary

CVE-2026-107271 is a medium (CVSS 6.9) Use of Less Trusted Source vulnerability in gophish. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-10-2026
   PublishedVulnerability first disclosed.
2. 07-10-2026
   Last modifiedVulnerability information updated.

Description

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never triggers, enabling unlimited password guessing and credential stuffing.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.