CWE-348 Use of Less Trusted Source

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Canonical ADSys Uses a Less Trusted Source

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Caddy Defender trusted proxy client IP bypass

OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Fabio allows HTTP clients to manipulate custom headers it adds

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

CasaOS Gateway vulnerable to incorrect identification of source IP addresses

OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand

HTTP client can manipulate custom HTTP headers that are added by Traefik

Serilog Client IP Spoofing vulnerability