CVE-2026-107271 gophish CVE debrief

Who should care

Defenders responsible for Gophish instances, especially those exposed to the internet, should assess exposure and verify the effectiveness of current rate limiting and IP spoofing mitigations.

Why it matters

CVE-2026-107271 is a rate limit bypass vulnerability in Gophish through version 0.12.1, allowing unauthenticated attackers to evade login throttling and enabling unlimited password guessing and credential stuffing attempts.

• Unlimited password guessing and credential stuffing attempts
• Potential for brute-force attacks against Gophish instances
• Need for verification of Gophish instance exposure and rate limiting effectiveness

Technical summary

The vulnerability allows unauthenticated attackers to evade login throttling by spoofing X-Forwarded-For or X-Real-IP headers, enabling unlimited password guessing and credential stuffing. This is possible because the limiter is keyed on rewritten RemoteAddr, allowing attackers to send a different forwarded address per request. The vulnerability affects Gophish through version 0.12.1 and has been confirmed by various sources, including the official CVE Program record and the NIST NVD detail page. Defenders should prioritize verifying exposure of Gophish instances, especially those exposed to the internet, and assess the effectiveness of current rate limiting and IP spoofing mitigations.

Defensive priority

Defenders should prioritize verifying exposure of Gophish instances, especially those exposed to the internet, and assess the effectiveness of current rate limiting and IP spoofing mitigations.

Recommended defensive actions

• Verify Gophish instance exposure and assess rate limiting effectiveness
• Implement additional authentication and IP validation measures
• Monitor for suspicious login attempts and credential stuffing attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and potential exploits. The vulnerability has been described in various sources, including the official CVE Program record and the NIST NVD detail page. However, the exact scope of affected systems and the efficacy of mitigations are not detailed in the provided sources. Defenders should verify Gophish instance exposure, assess rate limiting effectiveness, and monitor for potential

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.