# CVE-2026-126934: Zipline rate limit bypass via X-Forwarded-For spoofing

Source: https://junglewise.ai/threats/cve-2026-126934-zipline-4-3-2-before-4-8-0-contains-a-rate-limit-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126934 · Severity: medium · CVSS 6.5 · Published 2026-11-11

Zipline is a file-sharing and URL shortening service. A rate limiting flaw allows attackers to bypass login attempt throttling by spoofing X-Forwarded-For headers, enabling unlimited password and two-factor code guessing attacks without authentication. This puts user accounts at risk of unauthorized access.

Technologies: [Diced Zipline](https://junglewise.ai/threats/technologies/zipline). Vendors: [Diced](https://junglewise.ai/threats/vendors/diced).

## Quick answers

**Is CVE-2026-126934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126934 being exploited in the wild.

**How severe is CVE-2026-126934?** Medium severity, with a CVSS score of 6.5, published 11 November 2026.

**Which products and versions are affected?** Diced Zipline 4.3.2 before 4.8.0.

**Is there a fix for CVE-2026-126934?** Yes: fixed in 4.8.0. Until then: Disable core.trustProxy unless necessary for reverse proxy operation behind a trusted load balancer, or restrict X-Forwarded-For header acceptance to known trusted proxies only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126934 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126934?** Check whether you run Diced Zipline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.8.0

Disable core.trustProxy unless necessary for reverse proxy operation behind a trusted load balancer, or restrict X-Forwarded-For header acceptance to known trusted proxies only.

## Technical details

The vulnerability exploits Zipline's rate-limit implementation which uses the client IP address as the rate-limit key. When core.trustProxy is enabled, attackers can send a different X-Forwarded-For header per request to obtain a fresh rate-limit bucket, bypassing throttling on login and credential endpoints. This allows brute-force attacks against login passwords, TOTP codes, and file/URL passwords without authentication requirements.

## Affected products

- diced Zipline 4.3.2 before 4.8.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts](https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts)
- [https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts](https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts)

## Related threats

- [Zipline upload filter bypass via extension format mismatch](https://junglewise.ai/threats/cve-2026-126933-zipline-4-0-0-before-4-8-0-contains-an-upload-filter-bypass)
- [Zipline policy bypass in file metadata MIME type](https://junglewise.ai/threats/cve-2026-126932-zipline-4-6-2-before-4-8-0-contains-a-policy-bypass)