CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

Use of Less Trusted Source

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Use of Less Trusted Source via the IncomingRequest::isSecure function. An attacker can cause the application to incorrectly treat insecu...

GHSA-3Q9R-P662-5J8M Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

Summary There is a medium severity vulnerability in Traefik's ForwardAuth middleware. Even when configured with trustForwardHeader: false, Traefik derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. ...

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

Summary There is a medium severity vulnerability in Traefik's ForwardAuth middleware. Even when configured with trustForwardHeader: false, Traefik derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of the sanitized forwarded request. ...

EUVD-2026-41937

Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false...

CVE-2026-49331: Insufficient Verification of Data Authenticity

A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication skip-auth-regex, the proxy forwards client-supplied identity headers X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token to the upstream application without stripping them. An unauthenticated attacke...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

EUVD-2026-52437

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

CVE-2026-48061

Litestar prior to v2.22.0 is affected by CVE-2026-48061: AllowedHostsMiddleware may bypass host validation by using X-Forwarded-Host when Host is absent, enabling host-header injection (e.g., password reset links, cache keys, routing decisions). The issue occurs when no reverse proxy strips X-For...

CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

github.com/go-chi/chi/middleware: go-chi chi: IP spoofing via X-Forwarded-For header allows bypass of access controls

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...

github.com/go-chi/chi/middleware: go-chi/chi: IP spoofing via X-Forwarded-For header manipulation

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...

CVE-2026-48061: Improper Neutralization of HTTP Headers for Scripting Syntax

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

EUVD-2026-51595

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-25552

The CVE-2026-25552 entry concerns Ghost CLI before 1.30.1, where an IP spoofing vulnerability allows unauthenticated remote attackers to bypass rate-limiting on self-hosted Ghost instances. The underlying issue is misusing the X-Forwarded-For header in combination with a misconfigured Nginx setup...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-63220

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...