CVE-2026-103592 affects simple-php-router through version 5.4.1.7. The vulnerability resides in the IpRestrictAccess middleware, which improperly trusts less reliable HTTP headers for IP filtering. Attackers can spoof headers like X-Forwarded-For, CF-Connecting-IP, or Client-IP to impersonate whitelisted IP addresses or evade blacklists, thereby bypassing IP-based access controls. This allows unauthorized remote access to routes intended to be restricted by IP address.

The vulnerability allows remote unauthenticated attackers to bypass IP-based access restrictions, potentially granting unauthorized access to protected routes. This could lead to exposure of sensitive functionality or data that is intended to be accessible only from trusted IP addresses. The CVSS 4.0 base score is 6.9, indicating a medium severity impact with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid relying solely on the IpRestrictAccess middleware for IP-based access control or implement additional validation to prevent header spoofing.