CVE-2026-118657

A flaw was found in Echo. The framework unconditionally trusts forwarded scheme headers from incoming requests without verifying whether they originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending crafted HTTP headers to bypass HTTPS redirection controls or...