A flaw in Sencho’s /api/auth/login endpoint allows a remote attacker to alter the X-Forwarded-For header and trick the system into bypassing authentication controls. The vulnerability is a classic form of improper authentication (CWE‑287), enabling attackers to obtain unauthorized access without valid credentials. Consequences include full compromise of a user account and potential elevation of privileges with no additional attack vector required.

Studio‑Saelix Sencho versions up to 0.94.1 are affected, including any deployments that expose the /api/auth/login endpoint without limiting trusted proxy headers. Customers using the default configuration, which blindly trusts the X-Forwarded-For header, are at risk. The issue is vendor‑specific and does not extend to other products or platforms.

The CVSS score of 6.9 indicates moderate severity, but the exploit does not require privileged access and can be performed over the public internet. The lack of an EPSS score means the exploitation probability cannot be quantified at this time. The vulnerability is not yet listed in the CISA KEV catalog, yet the public disclosure and availability of a working exploit make it feasible to target. Attackers with network access to the exposed endpoint can replay or fabricate X-Forwarded-For values to impersonate legitimate users. The remediation path involves updating the login limiter to ignore untrusted forwarding headers unless explicitly configured.