CVE-2026-69183 affects Monkeytype version 26.26.0 and earlier, where the backend rate-limit key generator improperly trusts client-controlled HTTP headers (cf-connecting-ip and x-forwarded-for) over the proxy-derived req.ip value. An unauthenticated attacker can rotate these headers to generate new rate-limit buckets per request, effectively bypassing all rate limiting protections including rootRateLimiter and badAuthRateLimiter. This allows abuse of public endpoints such as POST /users/forgotPasswordEmail and verificationEmail, enabling mail bombing of registered users and exhaustion of Firebase or SMTP quotas. The vulnerability also undermines brute-force protection mechanisms, posing a resource exhaustion risk. Exploitation via x-forwarded-for is broadly applicable, while cf-connecting-ip exploitability depends on deployment topology. No fixed version was available at the time of review.
