CVE-2026-118657 Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure...

CVE-2026-118657

The Echo Go web framework (versions prior to 4.16.0 and 5.4.0 ) is vulnerable to an HTTPS redirect and HSTS bypass because Context.Scheme unconditionally trusts forwarded scheme headers from any client. An attacker can bypass HTTPSRedirect by claiming an HTTPS scheme over plaintext HTTP, or suppr...