CWE-348.

Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

• umputun remark42
• CWE-348
• CWE-807

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

• mayswind ezbookkeeping
• CWE-348

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

• Open redirect
• CWE-348

PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

• pipeshub-ai
• CWE-348

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

• CWE-345
• CWE-348

<5.4.0 · fixed in 5.4.0

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

• CWE-348

>=5.0.0, <5.4.1 · fixed in 5.4.1

Use of Less Trusted Source in GitLab

• GitLab
• CWE-348

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

• CWE-348

<=5.3.2 · no fixed version yet

Use of Less Trusted Source in hMailServer

• Progressive Robot Ltd hMailServer
• CWE-348

Use of Less Trusted Source in hMailServer

• Progressive Robot Ltd hMailServer
• CWE-348

Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header

• coder
• CWE-348

Wheels: Wheels through 4.1.1 derives its default production error-email address from the Host…

• Wheels
• CWE-348

Wheels: Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a…

• Wheels
• CWE-348

Resource allocation without limits in Eclipse Foundation Eclipse Connected Services Platform

• Eclipse Foundation Eclipse Connected Services Platform
• Denial of service
• CWE-348

Znuny: In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and…

• Znuny
• CWE-348

Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

• alexjustesen speedtest-tracker
• CWE-348

PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header

• schlagmichdoch PairDrop
• CWE-348

Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For

• smp46 pingvin-share-x
• CWE-348

Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-348

Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

• gophish
• CWE-348

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

• CWE-345
• CWE-348

>=2.1.0, <2.15.0 · fixed in 2.15.0

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• Authentication bypass
• CWE-348

>=1.1.0, <2.0.8 · fixed in 2.0.8

Irdeto Denuvo Anti-Tamper: Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via…

• Irdeto Denuvo Anti-Tamper
• CWE-348

simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers

• pecee simple-router
• CWE-348

UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host

• unopim
• CWE-348

Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source

• Trusted Domain Project OpenDKIM
• CWE-348

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated ...

• CWE-348

>=0.22.1, <0.28.0 · fixed in 0.28.0

wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

• wpForo Forum
• CWE-348

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.

• OpenStack Zaqar
• CWE-348

Use of Less Trusted Source in GitLab

• GitLab
• CWE-348

Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

• Red Hat Ansible Automation Platform 2.5 for RHEL 8
• Red Hat Ansible Automation Platform 2.5 for RHEL 9
• CWE-348

Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

• Forminator Forms
• CWE-348

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

• Authentication bypass
• CWE-348

>=1.6.6, <1.7.2 · fixed in 1.7.2

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

• Authentication bypass
• CWE-302

<0.31.4 || >=0.32.0, <0.32.2 · fixed in 0.31.4, 0.32.2

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

• Broken access control
• CWE-348

<1.0.7 · fixed in 1.0.7

@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• @fastify/proxy-addr
• Authentication bypass
• CWE-348

Forgejo: Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set…

• Forgejo
• CWE-348

Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

• PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module
• CWE-348

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

• CWE-348

>=5.8.3, <5.12.1 · fixed in 5.12.1

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

• Authentication bypass
• Server-side request forgery (SSRF)

<0.5.2 · fixed in 0.5.2

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

• CWE-348

<4.7.4 · fixed in 4.7.4

Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

• TryGhost Ghost-CLI
• CWE-348

'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

• NLnet Labs Unbound
• CWE-348

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

• CWE-348

>=4.3.3, <4.12.27 · fixed in 4.12.27

Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass

• glance
• CWE-348

FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers

• vastsa FileCodeBox
• CWE-348

Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kura

• Eclipse Foundation Eclipse Kura
• CWE-345
• CWE-348

Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

• nesquena hermes-webui
• CWE-348

OpenBSD OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…

• OpenBSD OpenSSH
• CWE-348

Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7…

• Dell PowerProtect Data Domain
• CWE-348

LibreTranslate - IP Spoofing via X-Forwarded-For Header

• LibreTranslate
• CWE-348

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

• Authentication bypass
• CWE-348

<=1.5.5 · no fixed version yet

Canonical ADSys Uses a Less Trusted Source

• CWE-348

<0.16.3-0.20250318112551-8b1939f96d38 · fixed in 0.16.3-0.20250318112551-8b1939f96d38

ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL

• sysown proxysql
• Broken access control
• CWE-348

Apache APISIX: wolf-rbac plugin Identity Spoofing

• Apache Software Foundation Apache APISIX
• CWE-348

hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

• CWE-348

<4.12.25 · fixed in 4.12.25

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

• CWE-348
• CWE-644

<2.22.0 · fixed in 2.22.0

OfflineIMAP: OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to…

• OfflineIMAP
• CWE-348

Caddy Defender trusted proxy client IP bypass

• Broken access control
• CWE-348

<0.10.1 · fixed in 0.10.1

HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

• hestiacp
• CWE-348