{"uuid": "48d44ffd-0ff1-4ce9-b0e6-b89366df2826", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63220", "type": "seen", "source": "https://gist.github.com/alon710/8161c68753a945887582acb72752fba7", "content": "# CVE-2026-63220: CVE-2026-63220: Trust of Untrusted Reverse Proxy Headers in CodeIgniter4\n\n> **CVSS Score:** 4.8\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63220\n\n## Summary\nCodeIgniter4 versions prior to v4.7.4 contain a protocol-spoofing vulnerability due to improper verification of upstream reverse proxy forwarding headers. Remote, unauthenticated attackers can inject headers like X-Forwarded-Proto to deceive the framework into identifying an insecure HTTP request as a secure HTTPS connection.\n\n## TL;DR\nUnauthenticated remote attackers can spoof HTTP forwarding headers to bypass HTTPS transport enforcement in CodeIgniter4 prior to version v4.7.4.\n\n## Technical Details\n\n- **CWE ID**: CWE-348\n- **Attack Vector**: Network\n- **CVSS Severity**: Medium (4.8)\n- **EPSS Score**: 0.00135\n- **Impact**: Protocol Spoofing, Secure Transport Bypass\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeIgniter4 Framework\n\n## Mitigation\n\n- Upgrade CodeIgniter4 to version v4.7.4 or later\n- Configure proxyIPs whitelist inside app/Config/App.php\n- Strip or overwrite incoming client-supplied forwarding headers at the network edge proxy\n\n**Remediation Steps:**\n1. Upgrade the application framework to version v4.7.4 using Composer: composer update codeigniter4/framework\n2. Open the configuration file app/Config/App.php\n3. Locate the $proxyIPs array property\n4. If behind a proxy, populate $proxyIPs with the exact IP addresses or CIDR ranges of your trusted proxies. Otherwise, ensure it remains an empty array.\n5. Verify the network edge configuration (e.g., Nginx, Apache, AWS ALB) to ensure it overrides X-Forwarded-Proto with verified scheme values.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63220) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T06:36:21.585283Z"}