Is CVE-2026-126934 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126934 being exploited in the wild.

How severe is CVE-2026-126934?

Medium severity, with a CVSS score of 6.5, published 11 November 2026.

Which products and versions are affected?

Diced Zipline 4.3.2 before 4.8.0.

How is CVE-2026-126934 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-126934?

Check whether you run Diced Zipline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126934: Zipline rate limit bypass via X-Forwarded-For spoofing

CVE-2026-126934 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Zipline is a file-sharing and URL shortening service. A rate limiting flaw allows attackers to bypass login attempt throttling by spoofing X-Forwarded-For headers, enabling unlimited password and two-factor code guessing attacks without authentication. This puts user accounts at risk of unauthorized access.

Technologies: Diced Zipline. Vendors: Diced.

Quick answers

Is CVE-2026-126934 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126934 being exploited in the wild.
How severe is CVE-2026-126934?: Medium severity, with a CVSS score of 6.5, published 11 November 2026.
Which products and versions are affected?: Diced Zipline 4.3.2 before 4.8.0.
Is there a fix for CVE-2026-126934?: Yes: fixed in 4.8.0. Until then: Disable core.trustProxy unless necessary for reverse proxy operation behind a trusted load balancer, or restrict X-Forwarded-For header acceptance to known trusted proxies only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126934 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-126934?: Check whether you run Diced Zipline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.8.0

Disable core.trustProxy unless necessary for reverse proxy operation behind a trusted load balancer, or restrict X-Forwarded-For header acceptance to known trusted proxies only.

Technical details

The vulnerability exploits Zipline's rate-limit implementation which uses the client IP address as the rate-limit key. When core.trustProxy is enabled, attackers can send a different X-Forwarded-For header per request to obtain a fresh rate-limit bucket, bypassing throttling on login and credential endpoints. This allows brute-force attacks against login passwords, TOTP codes, and file/URL passwords without authentication requirements.

Affected products

diced Zipline 4.3.2 before 4.8.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.