Skip to content
Threat Feed
Subscribe

Tag

X-Forwarded-For

1 brief RSS
high advisory

9router: Login Brute-Force Protection Bypass via Spoofed X-Forwarded-For Header

The 9router dashboard login rate limiter incorrectly uses the attacker-controlled X-Forwarded-For HTTP header to identify clients, leading to a brute-force protection bypass (CVE-2026-55501) that allows attackers to circumvent the lockout mechanism and conduct unlimited password brute-force attempts to gain administrative access.

9router brute-force rate-limit-bypass x-forwarded-for vulnerability web-application
1r 2t