What is CVE-2026-63220?
In CodeIgniter prior to version 4.7.4, the IncomingRequest::isSecure() method blindly trusts the X-Forwarded-Proto and Front-End-Https headers. This allows a remote attacker to spoof these headers and make the application treat an HTTP request as HTTPS. Upgrading to the latest version is recommended.
Azərbaycanca: CodeIgniter veb framework-ünün 4.7.4 öncəsi versiyalarında IncomingRequest::isSecure() funksiyası `X-Forwarded-Proto` və `Front-End-Https` başlıqlarına kor-koranə etibar edir. Bu boşluq uzaqdan hücum edənə saxta başlıqlarla HTTP sorğusunu HTTPS kimi göstərməyə imkan yaradır. Tətbiqi ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-20
FAQ2
Which versions of CodeIgniter are affected by CVE-2026-63220?
Versions of CodeIgniter prior to 4.7.4 are affected by this vulnerability.
Which HTTP headers can be manipulated in CVE-2026-63220?
The `X-Forwarded-Proto` and `Front-End-Https` headers can be manipulated in this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.