The Monkeytype backend uses client-controlled cf‑connecting‑ip and x‑forwarded‑for headers in its rate‑limit key generator before processing the trusted proxy‑derived req.ip value. An unauthenticated attacker can rotate these headers to create a unique bucket for each request, bypassing the rootRateLimiter, badAuthRateLimiter, getKey(), and getKeyWithUid() fallbacks used by public endpoints. This allows the attacker to repeatedly POST to /users/forgotPasswordEmail and /verificationEmail, bomb a target’s mailbox, consume Firebase or SMTP quotas, evade brute‑force protection and exhaust server resources. The vulnerability results in denial‑of‑service, large‑scale email spam, and potential compromise of user accounts through password reset abuse.

Monkeytype game (monkeytype) versions 26.26.0 and earlier are affected. The backend component responsible for rate limiting is the one mentioned in the description. No fixed version is currently available, so all deployments of 26.26.0 or earlier risk exploitation.

The CVSS score of 7.5 reflects the high impact of rate‑limit bypass and resource exhaustion. EPSS is not available, but the lack of a mitigation means the exploit is likely feasible in all affected deployments. The vulnerability can be exploited via crafted HTTP headers, which attackers can send from any client. The CVE is not listed in the CISA KEV catalog. Because the attack vector relies on client‑controlled headers, any deployment that does not properly trust a reverse proxy or validate IP sources is vulnerable. The risk to systems is moderate to high, especially for services that rely on the affected password‑reset or verification mail endpoints. Guidance from the vendor suggests waiting for a patch or applying the remediation steps described below.