cakephp-trusted-proxies

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-trusted-proxies Write-up: https://abraxaslabs.tech/research/cakephp-trusted-proxies cakephp-trusted-proxies Class: HTTPS redirect bypass / IP-host spoof Reach: Remote CakePHP 5.4.2 887b641 - Cake Software...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-118658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded- Proto, X-Forwarded-Protocol, or X-Url-Scheme without...

Echo: HTTPS Redirect And HSTS Bypass Via Unconditional Trust Of Forwarded Scheme Headers

Description "Context.Scheme" unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted header...

Echo Has Arbitrary Scheme Injection In WWWRedirect/NonWWWRedirect Middlewares Via X-Forwarded-Proto

Summary The "c.Scheme" method in Echo "context.go:162-181" trusts the "X-Forwarded-Proto", "X-Forwarded-Protocol", and "X-Url-Scheme" request headers without validating that the value is "http" or "https". The "WWWRedirect" and "NonWWWRedirect" middlewares use this unsanitized scheme to construct...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send X-Forwarded-Proto: https to an HTTP endpoint to bypass HTTPSRedirect, leaving users’...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send X-Forwarded-Proto: https to an HTTP endpoint to bypass HTTPSRedirect, leaving users’...

Reliance on Untrusted Inputs in a Security Decision

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send...

Reliance on Untrusted Inputs in a Security Decision

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the Scheme method in the Context component. An attacker can cause WWWRedirect, NonWWWRedirect, and their WithConfig variants to place an attacker-chosen URI scheme in the Location header by sending a request with a...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the Scheme method in the Context component. An attacker can cause WWWRedirect, NonWWWRedirect, and their WithConfig variants to place an attacker-chosen URI scheme in the Location header by sending a request with a...

DEBIAN-CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

UBUNTU-CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Description Context.Scheme unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers. The trusted headers...

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Summary The c.Scheme method in Echo context.go:162-181 trusts the X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme request headers without validating that the value is http or https. The WWWRedirect and NonWWWRedirect middlewares use this unsanitized scheme to construct redirect URLs,...

CVE-2026-118658 Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

CVE-2026-118658 Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...

CVE-2026-118658

Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker...