Executive brief
HedgeDoc is an open-source collaborative note-taking application. A security flaw allowed attackers to bypass rate-limiting protections on login and registration pages by spoofing their IP addresses. This could lead to automated brute-force attacks on user accounts or the creation of a large number of unauthorized accounts, potentially impacting service availability and security.
Technical details
HedgeDoc versions prior to 1.11.0 incorrectly prioritized the 'cf-connecting-ip' HTTP header over the actual client IP address for rate-limiting purposes, even when requests did not originate from Cloudflare. An attacker can exploit this by providing arbitrary IP addresses in the header, effectively resetting the rate-limit counter for every few requests. This enables large-scale automated attacks such as credential stuffing or account registration spam. The vulnerability is addressed in version 1.11.0 by introducing a configuration toggle (CMD_RATE_LIMIT_USING_CLOUDFLARE) that disables header trust by default.
Affected products
- HedgeDoc HedgeDoc < 1.11.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date