PipesHub AI versions before 0.10.0 have a flaw in its client IP determination logic that allows attackers to subvert per‑IP rate limiting by sending forged X‑Forwarded‑For or X‑Real‑IP headers. By rotating these spoofed header values, an unauthenticated user can repeatedly hit authentication endpoints such as password verification, OTP verification, or password‑reset email triggers, effectively performing password‑spraying or flooding attacks. This bypasses the intended service throttling, leading to potential credential compromise and denial‑of‑service for legitimate users.

The vulnerability affects Pipeshub AI (sometimes referred to as PipesHub) deployments running any release prior to version 0.10.0. The affected product is listed under the product name Pipeshub AI with the vendor Pipeshub‑AI. Users should check their installed version and upgrade if it is on an affected release.

The CVSS score of 6.9 classifies the issue as medium severity, and the EPSS score is not available, meaning the current exploit probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploit packages, but the flaw requires no authentication and depends only on HTTP header manipulation, making it trivially exploitable over the network. Attackers could simply send crafted requests with alternating X‑Forwarded‑For values to reset the rate‑limit buckets, enabling a large number of authentication trials. Given the lack of access controls on the affected endpoints, the risk to confidentiality and availability is significant.