Executive brief
Monkeytype is a popular web-based typing test application. An attacker can forge HTTP headers to bypass all rate-limiting controls, allowing them to send unlimited password-reset emails to victim accounts (mail bombing), exhaust email quota, and evade brute-force protections. This exposes users to account takeover attempts and impacts service availability for legitimate users.
Technical details
The vulnerability is a trust-boundary failure in the backend rate-limit middleware (backend/src/middlewares/rate-limit.ts). The getKey() function derives the per-client rate-limit bucket from client-supplied HTTP headers cf-connecting-ip and x-forwarded-for before falling back to Express's trust-proxy-derived req.ip. An unauthenticated attacker can rotate either header on each request to obtain a fresh rate-limit bucket, bypassing rootRateLimiter, badAuthRateLimiter, and public endpoint protections. This defeats the 1/minute limit on forgotPasswordEmail and 1/15-minute limit on verificationEmail, enabling mail bombing and quota exhaustion. The attack is network-reachable and requires no authentication. No patched version was available at the time of advisory publication.
Affected products
- monkeytypegame Monkeytype 26.26.0 and earlier
Timeline
- 2026-08-20: disclosed
- 2026-08-14: advisory: GitHub security advisory GHSA-c878-p3jh-mmjf published