CVE-2026-103592: simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. Attackers can spoof X-Forwarded-For, CF-Connecting-IP, or Client-IP headers to impersonate whitelisted addresses or evade blacklists, gaining access to IP-restricted routes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using simple-php-router through version 5.4.1.7 are exposed when they protect routes with the IpRestrictAccess middleware using IP whitelists or blacklists. The vulnerable restriction can be bypassed remotely without authentication.
What does an attacker need to exploit the bypass?
An attacker only needs network access to the application and the ability to send spoofed HTTP forwarding-related headers. The affected headers are X-Forwarded-For, CF-Connecting-IP, and Client-IP; no credentials or user interaction are required.
What access could a successful attacker gain?
An attacker can impersonate a whitelisted address or evade a blacklisted address, allowing access to routes that rely on the middleware's IP restrictions. The reported impact is limited to confidentiality and integrity, with no availability impact stated.