CVE-2026-37432

CVE-2026-37432 場所: Apiutil.java: 107-113 原則: X-Forwarded-For リクエストヘッダーを直接信頼しているため、偽装されてIPアドレスを操作される可能性があります。 悪用方法: X-Forwarded-For: 127.0.0.1...

auth-header-trust-rules

auth-header-trust-rules 一个小的 Semgrep 规则包，用于标记基于攻击者控制的 HTTP 请求头做出认证、授权或信任决策的代码。 该漏洞类的典型示例是 CVE-2025-29927：Next.js 信任 x-middleware-subrequest 头来决定中间件是否运行，任何提供了精心构造值的入站请求都可以完全跳过中间件。同样的模式在各个框架和生态系统中反复出现。 此规则包涵盖了两种语言系列和该漏洞的三个子类。它旨在作为代码审查辅助工具，而非完全调优的 CI 门禁。规则偏向于召回率而非精确度，最好以交互方式运行，由人工对每个发现做出判断。...

CVE-2026-78560

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

Thank-u-Next

Thank u Next – CVE-2025-29927 漏洞利用工具 🧠 什么是 CVE-2025-29927？ 这不仅仅是绕过——这是一种启示。一个被中间件逻辑误解和处理不当的请求头，变成了本应被锁定的资产的万能钥匙。 CVE-2025-29927 利用了配置错误的中间件授权层 ——具体来说，就是那些盲目信任 x-middleware-subrequest 请求头而不验证其来源或上下文的系统。 用简单的话说？ 你只需添加一个请求头，砰——你就进去了。无需认证，无需令牌，只有纯粹的支配。 🚀 漏洞工作原理（技术解析） 1. 漏洞根源： 许多现代 Web 应用使用中间件来拦截和处理 A...

CVE-2025-29927-Nextjs-Bypass-PoC

PoC: CVE-2025-29927 - Next.js 中间件绕过 本仓库包含一个概念验证（PoC），演示了如何通过利用与内部 HTTP 标头相关的漏洞，绕过 Next.js v13.5.6 中的中间件安全检查。 漏洞概述：CVE-2025-29927 这是什么？ CVE-2025-29927 是一个 中间件绕过 漏洞，存在于 Next.js 1.11.4 及以下，以及 12.3.5、13.5.9、14.2.25 和 15.2.3 之前的版本中。它允许外部攻击者跳过开发者在 middleware.ts 文件中实现的安全逻辑——例如身份验证、机器人检测或地理位置重定向。 根本原因：标头...

eda-server: ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

SUSE CVE-2026-55430

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost which prefers the X-Forwarded-Host header over the real Host header. No middleware...

CVE-2026-12383

The CVE-2026-12383 entry describes a flaw in the Event-Driven Ansible (EDA) server where ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny] , authentication_classes=[] ), relying solely on the Subject header for mTLS authentication and not validating that th...

CVE-2026-12383 Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

GHSA-46Q4-43PH-C6FR blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

CVE-2026-44437

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR. The internal validation mechanism fails to properly...

CVE-2026-33495

ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the...

CVE-2026-33690

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the getRealIpAddr function in objects/functions.php trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-base...

CVE-2026-33246 NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The nats-server offers a Nats-Request-Info: message header, providing information about a request. This is supposed to provide enough information to allow for account/user identification, such that NAT...

HomeBox 安全漏洞

HomeBox is an open-source system developed by SysAdmins Media for home users. Versions of HomeBox prior to 0.24.0 contained security vulnerabilities. These vulnerabilities stemmed from the identity authentication rate limiter unconditionally reading and trusting headers like X-Real-IP, with...

CVE-2026-27812

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning Host Header / Forwarded Header trust issue, which allows attackers to manipulate the password reset link...

CVE-2026-27812

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning Host Header / Forwarded Header trust issue, which allows attackers to manipulate the password reset link...

CVE-2026-27812 Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning Host Header / Forwarded Header trust issue, which allows attackers to manipulate the password reset link...

EUVD-2026-8782

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning Host Header / Forwarded Header trust issue, which allows attackers to manipulate the password reset link...

CVE-2026-27812 Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. A vulnerability in versions prior to 0.1.85 is a Password Reset Poisoning Host Header / Forwarded Header trust issue, which allows attackers to manipulate the password reset link...