GHSA-WCHH-MRV2-5H4Q ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Summary A remote attacker from any IP address defeats the operator-configured source-IP allowlist mcpallowedremoteips / apitokenallowedremoteips by sending a single X-Forwarded-For: header. The router is created with gin.New and never calls SetTrustedProxies, so gin trusts every proxy by default...