CVE Intelligence

Alexjustesen Speedtest-tracker vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Alexjustesen Speedtest-tracker: 1 record(s), with affected versions and fixes.

CVE-2026-108736 Low · 3.7 CWE-348 Oct 11, 2026
Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.