CVE-2019-17240

CVE-2019-17240 is a critical vulnerability affecting Bludit 3.9.2, allowing attackers to bypass the brute-force protection mechanism. This is achieved by manipulating X-Forwarded-For or Client-IP HTTP headers, making it appear as if multiple login attempts originate from different sources. With a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, leading to potential complete compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code is publicly available on ExploitDB, and there is significant community discussion, including a Go language implementation of the bypass.