Gophish versions through 0.12.1 contain a rate‑limit bypass that permits an unauthenticated attacker to evade the login throttling mechanism by sending different spoofed X‑Forwarded‑For or X‑Real‑IP headers on each request. Because the rate limiter keys requests by the rewritten RemoteAddr field, the attacker can supply a distinct forwarded address each time, rendering the limiter ineffective. This flaw therefore enables unlimited password guessing and credential‑stuffing attempts against the /login endpoint without triggering the configured limits.

The vulnerability affects Gophish (the open‑source phishing platform) in all releases up to and including 0.12.1. No specific patch version is mentioned in the advisory; users should upgrade to any available version that addresses the rate‑limit key handling to eliminate the flaw.

The CVSS base score of 6.9 indicates moderate severity. With an EPSS score not available and the vulnerability not listed in the CISA KEV catalog, the overall exploitation likelihood remains uncertain but could be non‑negligible in environments where Gophish is deployed behind a proxy or network load balancer that allows X‑Forwarded‑For manipulation. The bypass allows an attacker to conduct credential stuffing attacks that would otherwise be throttled, potentially compromising user accounts if strong passwords are not enforced or account lockout policies are absent.