A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00553.

Exploitation poc

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a Saleor affected
Version Status Constraints
3.20.118 affected —
3.21.0 affected —
3.21.1 affected —
3.21.2 affected —
3.21.3 affected —
3.21.4 affected —
3.21.5 affected —
3.21.6 affected —
3.21.7 affected —
3.21.8 affected —
3.21.9 affected —
3.21.10 affected —
3.21.11 affected —
3.21.12 affected —
3.21.13 affected —
3.21.14 affected —
3.21.15 affected —
3.21.16 affected —
3.21.17 affected —
3.21.18 affected —
3.21.19 affected —
3.21.20 affected —
3.21.21 affected —
3.21.22 affected —
3.21.23 affected —
3.21.24 affected —
3.21.25 affected —
3.21.26 affected —
3.21.27 affected —
3.21.28 affected —
3.21.29 affected —
3.21.30 affected —
3.21.31 affected —
3.21.32 affected —
3.21.33 affected —
3.21.34 affected —
3.21.35 affected —
3.21.36 affected —
3.21.37 affected —
3.21.38 affected —
3.21.39 affected —
3.21.40 affected —
3.21.41 affected —
3.21.42 affected —
3.21.43 affected —
3.21.44 affected —
3.21.45 affected —
3.21.46 affected —
3.21.47 affected —
3.21.48 affected —
3.21.49 affected —
3.21.50 affected —
3.21.51 affected —
3.21.52 affected —
3.21.53 affected —
3.21.54 affected —
3.22.0 affected —
3.22.1 affected —
3.22.2 affected —
3.22.3 affected —
3.22.4 affected —
3.22.5 affected —
3.22.6 affected —
3.22.7 affected —
3.22.8 affected —
3.22.9 affected —
3.22.10 affected —
3.22.11 affected —
3.22.12 affected —
3.22.13 affected —
3.22.14 affected —
3.22.15 affected —
3.22.16 affected —
3.22.17 affected —
3.22.18 affected —
3.22.19 affected —
3.22.20 affected —
3.22.21 affected —
3.22.22 affected —
3.22.23 affected —
3.22.24 affected —
3.22.25 affected —
3.22.26 affected —
3.22.27 affected —
3.22.28 affected —
3.22.29 affected —
3.22.30 affected —
3.22.31 affected —
3.22.32 affected —
3.22.33 affected —
3.22.34 affected —
3.22.35 affected —
3.22.36 affected —
3.22.37 affected —
3.22.38 affected —
3.22.39 affected —
3.22.40 affected —
3.22.41 affected —
3.22.42 affected —
3.22.43 affected —
3.22.44 affected —
3.22.45 affected —
3.22.46 affected —
3.22.47 affected —
3.23.0 affected —
3.23.1 affected —
3.23.2 affected —
3.23.3 affected —
3.23.4 affected —
3.23.5 affected —
3.23.6 affected —
3.23.7 affected —
3.23.8 affected —
3.23.9 affected —
3.23.10 affected —
3.23.11 affected —
3.23.12 affected —
3.23.13 affected —
3.23.14 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Saleor Subscribe
Saleor Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/saleor/saleor/ cve-icon cve-icon
https://github.com/saleor/saleor/issues/19203 cve-icon cve-icon
https://github.com/zast-ai/vulnerability-reports/blob/main/saleor/bruteforce.md cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-93650 cve-icon cve-icon
https://vuldb.com/submit/933655 cve-icon cve-icon
https://vuldb.com/vuln/407477 cve-icon cve-icon
https://vuldb.com/vuln/407477/cti cve-icon cve-icon
History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of the file saleor/account/throttling.py. Executing a manipulation can lead to improper restriction of excessive authentication attempts. The attack can be executed remotely. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The projects own issue #19203 internal ticket admits "IP can be spoofed in most deployments" and that its REAL_IP_ENVIRON-type setting bypasses get_client_ip; fix (right-to-left RFC 7239 hop selection) proposed but still unmerged. The vendor explains within an email, that "[t]his is not a vulnerability, this is working at intended, Saleor expects XFF to be configured properly".
Title Saleor throttling.py get_client_ip excessive authentication
First Time appeared Saleor
Saleor saleor
Weaknesses CWE-307
CWE-799
CPEs cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*
Vendors & Products Saleor
Saleor saleor
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-18T19:47:52.282Z

Reserved: 2026-09-18T13:07:36.010Z

Link: CVE-2026-93650

cve-icon Vulnrichment

Updated: 2026-09-18T19:47:49.150Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T19:17:24.973

Modified: 2026-09-18T20:17:33.177

Link: CVE-2026-93650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T16:15:13Z

Weaknesses