CVE-2026-126937
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.