CVE-2026-108522 in Sencho
Prediction
by VulDB Data Team • 10/10/2026
A vulnerability was found in <a href="/product/studio-saelix:sencho">Studio-Saelix Sencho up to 0.94.1</a>. This affects an unknown part of the file <em>/api/auth/login</em> of the component <em>Login Endpoint</em>. Performing a manipulation of the argument <em>X-Forwarded-For</em> results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named <em>79b86ddcd4aefdd6941f098e35990ab397b13c72</em>. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."
If you want to get best quality of vulnerability data, you may have to visit VulDB.