Base de CVEs

CVE-2026-63220 Média · 4.8 CWE-348 31/07/2026

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may have impacted applications that rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. Exploitability depends on deployment configuration. Applications are most exposed if the backend is reachable directly over HTTP, or if a reverse proxy/load balancer forwards client-supplied forwarding headers without stripping or overwriting them. This issue has been fixed in version 4.7.4.

CVE-2026-50243 Baixa · 3.7 CWE-348 22/07/2026

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a 'response-ip'/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator's configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator's configured target.

CVE-2026-64619 Alta · 7.5 CWE-348 20/07/2026

FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers can supply unique spoofed IP values on each request to enumerate all possible share codes and retrieve other users' files without authentication.

CVE-2026-63770 Alta · 7.5 CWE-348 20/07/2026

Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.

CVE-2026-58122 Crítica · 9.1 CWE-348 09/07/2026

Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.

CVE-2026-59897 Média · 5.3 CWE-348 08/07/2026

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27.

CVE-2026-59999 Alta · 7.5 CWE-348 07/07/2026

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

CVE-2026-46466 Baixa · 2.7 CWE-348 03/07/2026

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of less trusted source vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.

CVE-2026-57942 Média · 5.3 CWE-348 29/06/2026

LibreTranslate - IP Spoofing via X-Forwarded-For Header

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.

CVE-2026-54289 Média · 4.8 CWE-348 22/06/2026

Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more than once as several separate entries. The adapter writes each value with Headers.set instead of Headers.append, so every value overwrites the previous one and only the last reaches the application. Repeated request headers such as X-Forwarded-For, Forwarded, and Via are silently truncated to a single value. Request middleware sees only the last value of a repeated header instead of the full chain. For applications that base access control on the X-Forwarded-For chain, this can weaken or alter that decision; for auditing, hop history is lost. This vulnerability is fixed in 4.12.25.

CVE-2026-12249 Crítica · 9.0 CWE-348 22/06/2026

Canonical ADSys: recuperação de certificado CA via HTTP sem criptografia permite envenenamento do repositório de confiança

Foi identificado um problema no Canonical ADSys nas versões upstream até a v0.16.2. Durante o auto-registro de certificados do Active Directory Certificate Services (AD CS) por meio do script cliente Samba vendorizado (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), o ADSys utiliza uma conexão HTTP sem criptografia (http://) em vez de uma conexão HTTPS segura (https://) para solicitar o certificado da CA ao servidor AD CS (GetCACert). Um atacante de rede não autenticado posicionado entre o host Ubuntu gerenciado e o nome de host da CA configurada no AD CS pode realizar um ataque de Man-in-the-Middle (MITM). Ao interceptar a requisição HTTP em texto claro, o atacante pode fornecer um certificado de Root CA arbitrário, controlado por ele. Como o sistema aceita automaticamente esse certificado e o registra no repositório de confiança local do sistema via update-ca-certificates, isso resulta em envenenamento do repositório de confiança de todo o sistema. Consequentemente, clientes TLS que utilizam o repositório de confiança do sistema operacional na máquina afetada aceitarão certificados falsos para domínios arbitrários, permitindo a descriptografia e interceptação persistentes de conexões TLS subsequentes. Este problema foi resolvido na versão v0.16.3.

CVE-2026-48772 Crítica · 10.0 CWE-348 19/06/2026

ProxySQL: spoofing de cabeçalho PROXY permite bypass de roteamento e ACL por client_addr

ProxySQL é um proxy para MySQL e seus forks, bem como para PostgreSQL. Nas versões 2.0.0 até 3.0.8, o frontend MySQL do ProxySQL aceita o frame PP1 `PROXY UNKNOWN <addr> <addr> <port> <port>\r\n` como um cabeçalho de protocolo PROXY bem formado. A especificação do protocolo PROXY v1 do HAProxy afirma que, quando o token de protocolo é `UNKNOWN`, o receptor DEVE ignorar quaisquer campos de endereço que o seguem, porque o proxy declarou que não consegue determinar a identidade do cliente. O ProxySQL analisa esses campos de endereço mesmo assim, via `sscanf`, e grava o endereço de origem forjado no campo `addr.addr` da sessão. Dali ele flui diretamente para o avaliador de regras de consulta, onde o predicado `client_addr` decide roteamento e ACL. Quando `mysql-proxy_protocol_networks = '*'` (o padrão), qualquer peer TCP pode enviar um frame PP1 e escolher qualquer alegação de IP de origem. Com isso, qualquer linha de `mysql_query_rules` fixada a um valor de `client_addr` pode ser forjada: o atacante escreve o endereço que deseja casar na linha PP1, e o ProxySQL roteia sua consulta como se viesse desse endereço. Na prática, trata-se de bypass de roteamento e de ACL. Implantações reais usam `client_addr` para separação de leitura e escrita (aplicações internas vão ao primário, tráfego público para réplicas de leitura), fixação de schema por aplicação e regras de filtro de consultas (DDL permitido somente a partir de CIDR administrativo, consultas públicas com padrões perigosos bloqueadas). Um atacante que consiga alcançar a porta do frontend pode forjar seu caminho para qualquer uma dessas rotas. A versão 3.0.9 corrige este problema.

CVE-2026-44046 Média · 5.8 CWE-348 19/06/2026

Apache APISIX: wolf-rbac plugin Identity Spoofing

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

CVE-2020-37248 Média · 6.5 CWE-348 08/06/2026

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to…

OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.

CVE-2026-43634 Alta · 7.5 CWE-348 19/05/2026

HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.

CVE-2026-40226 Média · 6.4 CWE-348 10/04/2026

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via…

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

CVE-2026-35391 Alta · 7.5 CWE-348 06/04/2026

Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling rate limit bypass and audit log forgery

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client. An attacker could forge their source IP address to bypass IP-based rate limiting (enabling brute-force attacks against the admin login) or forge audit log entries (making malicious activity appear to originate from arbitrary IP addresses). This vulnerability is fixed in 1.4.11.

CVE-2026-35507 Média · 6.5 CWE-348 02/04/2026

Shynet before 0.14.0 allows Host header injection in the password reset flow.

CVE-2026-26927 Média · 5.1 CWE-348 02/04/2026

URL (HTTP Origin) call location spoofing in Szafir SDK Web

Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL (HTTP Origin) of the application call location. An unauthenticated attacker can craft a website that is able to launch SzafirHost application with arbitrary arguments via Szafir SDK Web browser addon. No validation will be performed to check whether the address specified in `document_base_url` parameter is in any way related to the actual address of the calling web application. The URL address specified in `document_base_url` parameter is then shown in the application confirmation prompt. When a victim confirms the execution of the application, it will be called in the context of attacker's website URL and might download additional files and libraries from that website. When victim accepts the application execution for the URL showed in the confirmation prompt with the "remember" option before, the prompt won't be shown and the application will be called in the context of URL provided by the attacker without any interaction. This issue was fixed in version 0.0.17.4.

CVE-2026-33690 Média · 5.3 CWE-348 23/03/2026

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.

CVE-2026-3635 Média · 6.1 CWE-348 23/03/2026

Fastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust function

Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. Affected Versions fastify <= 5.8.2 Impact Applications using request.protocol or request.host for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when trustProxy is configured with a restrictive trust function. When trustProxy: true (trust everything), both host and protocol trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations.

CVE-2025-69240 Alta · 8.8 CWE-348 16/03/2026

Header Poisoning in Raytha CMS

Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim's email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim's password and take over the victim's account. This issue was fixed in version 1.4.6.

CVE-2026-22201 Média · 5.3 CWE-348 13/03/2026

wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()

wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls.

CVE-2025-55292 Alta · 8.2 CWE-348 27/01/2026

In Meshtastic, an attacker can spoof licensed amateur flag for a node

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by abusing the HAM mode which doesn't use encryption. An attacker can, as such, forge a NodeInfo on behalf of a victim node advertising that the HAM mode is enabled. This, in turn, will allow the other nodes on the mesh to accept the new information and overwriting the NodeDB. The other nodes will then only be able to send direct messages to the victim by using the shared channel key instead of the PKC. Additionally, because HAM mode by design doesn't provide any confidentiality or authentication of information, the attacker could potentially also be able to change the Node details, like the full name, short code, etc. To keep the attack persistent, it is enough to regularly resend the forged NodeInfo, in particular right after the victim sends their own. A patch is available in version 2.7.6.834c3c5.

CVE-2026-24910 Média · 5.9 CWE-348 27/01/2026

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be…

In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).