CVE-2026-63220: Trust of Untrusted Reverse Proxy Headers in CodeIgniter4
Vulnerability ID: CVE-2026-63220
CVSS Score: 4.8
Published: 2026-08-07
CodeIgniter4 versions prior to v4.7.4 contain a protocol-spoofing vulnerability due to improper verification of upstream reverse proxy forwarding headers. Remote, unauthenticated attackers can inject headers like X-Forwarded-Proto to deceive the framework into identifying an insecure HTTP request as a secure HTTPS connection.
TL;DR
Unauthenticated remote attackers can spoof HTTP forwarding headers to bypass HTTPS transport enforcement in CodeIgniter4 prior to version v4.7.4.
Technical Details
- CWE ID: CWE-348
- Attack Vector: Network
- CVSS Severity: Medium (4.8)
- EPSS Score: 0.00135
- Impact: Protocol Spoofing, Secure Transport Bypass
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- CodeIgniter4 Framework
Mitigation Strategies
- Upgrade CodeIgniter4 to version v4.7.4 or later
- Configure proxyIPs whitelist inside app/Config/App.php
- Strip or overwrite incoming client-supplied forwarding headers at the network edge proxy
Remediation Steps:
- Upgrade the application framework to version v4.7.4 using Composer: composer update codeigniter4/framework
- Open the configuration file app/Config/App.php
- Locate the $proxyIPs array property
- If behind a proxy, populate $proxyIPs with the exact IP addresses or CIDR ranges of your trusted proxies. Otherwise, ensure it remains an empty array.
- Verify the network edge configuration (e.g., Nginx, Apache, AWS ALB) to ensure it overrides X-Forwarded-Proto with verified scheme values.
Read the full report for CVE-2026-63220 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)