CVE-2026-93650
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Saleor throttling.py get_client_ip excessive authentication
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Saleor
- Vendor
- n/a
- Product
- Saleor
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 3.20.118 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.6 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.11 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.12 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.13 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.14 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.16 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.17 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.18 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.19 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.20 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.21 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.22 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.23 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.24 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.25 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.26 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.27 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.28 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.29 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.30 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.31 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.32 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.33 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.34 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.35 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.36 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.37 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.38 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.39 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.40 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.41 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.42 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.43 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.44 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.45 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.46 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.47 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.48 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.49 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.50 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.51 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.52 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.53 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.21.54 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.6 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.11 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.12 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.13 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.14 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.16 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.17 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.18 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.19 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.20 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.21 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.22 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.23 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.24 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.25 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.26 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.27 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.28 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.29 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.30 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.31 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.32 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.33 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.34 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.35 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.36 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.37 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.38 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.39 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.40 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.41 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.42 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.43 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.44 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.45 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.46 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.22.47 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.3 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.6 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.8 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.9 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.11 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.12 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.13 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 3.23.14 | affected | Unavailable | Unavailable | Unavailable | None listed |