CVE-2026-69183 in Monkeytype
Summary
by MITRE • 08/20/2026
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Monkeytype versions 26.26.0 and earlier represents a critical failure in access control logic, specifically within the backend rate-limiting middleware located at backend/src/middlewares/rate-limit.ts. This flaw stems from an improper prioritization of client-supplied headers over trusted network identifiers during the generation of rate-limit keys. In secure architectural designs, applications operating behind reverse proxies or load balancers must rely on IP addresses derived from trusted sources to prevent identity spoofing. However, in this implementation, the system processes the cf-connecting-ip and x-forwarded-for headers before evaluating the trust-proxy-derived req.ip value. This ordering error allows an unauthenticated attacker to manipulate these HTTP headers to construct arbitrary rate-limit keys, effectively bypassing the intended throttling mechanisms designed to protect sensitive endpoints from abuse.
The operational impact of this vulnerability is severe, as it enables a range of malicious activities that compromise both system integrity and user safety. By rotating the cf-connecting-ip or x-forwarded-for headers for each request, an attacker can create unique rate-limit buckets for every single interaction with protected API endpoints. This capability allows the bypass of rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback mechanisms that are typically applied to public-facing routes. Consequently, attackers can execute repeated POST requests to /users/forgotPasswordEmail and verificationEmail endpoints without triggering rate limits. This leads directly to mail bombing attacks against registered users, where victims receive an overwhelming volume of automated emails, causing significant disruption and potential reputational damage for the platform.
Furthermore, this vulnerability facilitates resource exhaustion and financial impact through quota consumption. The ability to bypass brute-force protections means that attackers can attempt unlimited password resets or email verifications without restriction. This activity consumes substantial computational resources on the server side and drains external service quotas, such as those associated with Firebase authentication services or SMTP mail servers. For organizations relying on pay-per-use cloud infrastructure, this results in direct financial loss due to excessive API calls and email sending costs. The lack of a fixed version as of the review period exacerbates the risk, leaving deployments vulnerable until manual mitigation strategies are implemented by system administrators.
From a classification perspective, this vulnerability aligns with CWE-798: Use of Hard-coded Credentials or Default Values in terms of logic flaws where trusted values are not properly validated, but more accurately fits CWE-284: Improper Access Control and CWE-306: Missing Authentication for Critical Function. The attack vector is consistent with MITRE ATT&CK technique T1190: Exploit Public-Facing Application, specifically leveraging misconfigured access controls to bypass security mechanisms like rate limiting which are intended to mitigate automated attacks such as brute force or credential stuffing. To mitigate this issue in the absence of an official patch, administrators should configure their reverse proxies or web application firewalls to strip or overwrite x-forwarded-for and cf-connecting-ip headers with trusted values before they reach the Monkeytype backend. Additionally, enforcing strict validation on all incoming IP addresses and ensuring that rate-limit keys are derived exclusively from server-resolved client IPs rather than user-controllable HTTP headers is essential for restoring security posture.