CVE-2024-35538: Typecho · Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, organizations should implement strict validation of the X-Forwarded-For and Client-Ip headers, especially if these headers are used to determine client IP addresses for security decisions. Ideally, these headers should only be trusted if they originate from known and secure reverse proxies or load balancers. If Typecho is deployed behind a trusted proxy, configure the proxy to sanitize or overwrite these headers and configure Typecho to accept client IPs only from the proxy. If no proxy is used, consider ignoring these headers entirely. Additionally, implement multi-factor authentication and other security controls that do not rely solely on IP-based restrictions. Regularly monitor logs for suspicious IP address patterns and update Typecho to newer versions once a patch is released. Network-level protections such as Web Application Firewalls (WAFs) can also be configured to detect and block suspicious header manipulations. Finally, educate administrators about the risks of trusting client-supplied IP headers.
Description
Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.