CVE-2026-126400
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 13, 2026
Vendor
unknown
Description
Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.