{"id":"CVE-2026-113703","published":"2026-10-20T16:17:13.507","lastModified":"2026-10-20T20:11:29.833","description":"SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middleware.py trusts the client-controlled request.remote_addr value, which is derived from the spoofable X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Attackers can send a request with X-Forwarded-For set to a trusted CIDR address such as 127.0.0.1 to be granted an unauthenticated admin session via _load_bypass_user_context(), gaining full administrative access to endpoints like /api/users and /api/jobs without providing any credentials.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v3.0.0","tags":[]},{"url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","tags":[]},{"url":"https://www.vulncheck.com/advisories/suggestarr-before-authentication-bypass-via-x-forwarded-for-spoofing","tags":[]},{"url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","tags":[]}],"exploitRefs":[{"url":"https://github.com/giuseppe99barchetta/SuggestArr/releases/tag/v3.0.0","tags":[]},{"url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","tags":[]},{"url":"https://github.com/giuseppe99barchetta/SuggestArr/security/advisories/GHSA-fcjm-xhw8-pmh5","tags":[]}],"hasPoc":true,"ai":{"summary":"The SuggestArr application contains an authentication bypass vulnerability where attackers can spoof their IP address to gain admin access without credentials. This allows full administrative control over user and job management endpoints.","exploitability":"Easy to exploit with a single HTTP request setting X-Forwarded-For header to a trusted IP like 127.0.0.1, requiring no prior authentication or credentials.","blast_radius":"High impact as attackers can access sensitive administrative endpoints like /api/users and /api/jobs without any authentication, potentially leading to complete system compromise.","remediation":"Upgrade to SuggestArr 3.0.0 or later to fix the authentication bypass vulnerability.","detection":"Monitor for requests with X-Forwarded-For header containing trusted IP addresses like 127.0.0.1 that access administrative endpoints (/api/users, /api/jobs) without proper authentication tokens in the logs.","tags":["auth-bypass","web","authentication","api"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:26:13.366Z"}}