CVE-2026-108522

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."

• CWE-287

• https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a
• https://github.com/Studio-Saelix/sencho/
• https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72
• https://github.com/Studio-Saelix/sencho/pull/1877
• https://vuldb.com/cve/CVE-2026-108522
• https://vuldb.com/submit/893366
• https://vuldb.com/vuln/416188
• https://vuldb.com/vuln/416188/cti

Published

Oct 11, 2026

Last Modified

Oct 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108503ZTE Z80 Ultra has an interface permission validation vulnera…3.3
• CVE-2026-108504ZTE Z80 Ultra has an unauthorized information disclosure vul…5.5
• CVE-2026-108505ZTE Z80 Ultra has a local information disclosure vulnerabili…3.3
• CVE-2026-108506ZTE Z80 Ultra's system interfaces do not have robust invocat…5.5
• CVE-2026-10852IBM WebSphere Application Server and IBM WebSphere Applicati…7.5
• CVE-2026-108521A vulnerability has been found in Studio-Saelix Sencho up to…4.7
• CVE-2026-10853IBM MQ could allow an authenticated attacker with cluster ac…8.8
• CVE-2026-10854A visibility control issue in the event template creation wo…4.3
• CVE-2026-108545SillyTavern 1.12.13 through 1.19.0 contains a denial of serv…5.9
• CVE-2026-108546Spotweb through 1.5.8 contains an OS command injection vulne…7.5
• CVE-2026-108547AstronRPA through 1.1.6 contains a missing tenant authorizat…6.5
• CVE-2026-108548AstronRPA through 1.1.6 contains an authentication bypass vu…7.3