CVE-2026-113703: Authentication Bypass by Spoofing in giuseppe99barchetta SuggestArr

SuggestArr before version 3.0.0 has an authentication bypass vulnerability in its local_bypass authentication mode. The enforce_authentication() function in api_service/auth/middleware.py relies on request.remote_addr, which is derived from the X-Forwarded-For header due to ProxyFix(x_for=1) configuration in api_service/app.py. Since X-Forwarded-For is client-controlled and spoofable, an attacker can set it to a trusted CIDR like 127.0.0.1 to bypass authentication checks. This leads to unauthorized admin session creation via _load_bypass_user_context(), granting full administrative access to endpoints such as /api/users and /api/jobs without providing credentials.

An attacker can gain full administrative access to SuggestArr's API endpoints without authentication by spoofing the X-Forwarded-For header. This compromises the confidentiality, integrity, and availability of the application’s administrative functions, potentially allowing unauthorized user and job management.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the local_bypass authentication mode or restrict access to trusted networks at the infrastructure level to prevent spoofed X-Forwarded-For headers.