CVE-2026-34025 describes an authentication bypass vulnerability in Wertheim GmbH's SafeController Software for vault rooms (AssemblyVersion 6.15.8328.28014). The software restricts user logins based on the client IP address associated with a branch location. However, it derives the client IP from the HTTP X-Forwarded-For header when present. This allows an attacker who possesses valid branch user credentials to manipulate the X-Forwarded-For header during login, spoofing the expected branch IP address. Consequently, the attacker can obtain a valid authenticated session from an unauthorized network location, bypassing IP-based access controls.

An attacker with valid branch credentials can bypass IP-based login restrictions by spoofing the X-Forwarded-For header, enabling unauthorized access from network locations outside the authorized branch IP ranges. This undermines the intended network-based access control, potentially allowing unauthorized physical or logical access to vault room management functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider additional network-level controls to validate client IPs, such as enforcing trusted proxy configurations or disabling reliance on the X-Forwarded-For header for authentication decisions. Monitoring for anomalous login locations may also help detect exploitation attempts.