Broken Rate Limiting

This API limits login attempts to 5 per minute per IP address.

But the IP address comes from... the request itself.

Try the login API:

POST /api/login
Content-Type: application/json

{"username": "admin", "password": "guess"}

After 5 failed attempts from one IP, try setting the X-Forwarded-For header to a different IP.

Correct password grants the flag.