Unauthenticated rate-limit bypass via spoofed client addresses

Authentication rate-limit bypass in Ghost 5.85.1 and earlier allows remote attackers to evade login throttling using crafted HTTP headers. Ghost derives the client identity used by its authentication rate limiter from attacker-controlled X-Forwarded-For values, letting different values create distinct rate-limit buckets. The issue is reachable without authentication when an upstream proxy forwards untrusted X-Forwarded-For values; the vendor disputes applicability to correctly proxied installations, and the bounded consequence is sustained password guessing rather than guaranteed account access.