This vulnerability (CVE-2026-40460) involves an authentication bypass by spoofing (CWE-290) in F5 NGINX Plus and NGINX Open Source products when using the HTTP/3 QUIC module. An attacker can spoof their source IP address, which may allow them to bypass authorization mechanisms or rate limiting protections. The issue affects specific versions R32 and R36. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and availability impact. No patch or official fix has been documented by the vendor yet.

An attacker exploiting this vulnerability could bypass authorization checks or rate limiting by spoofing their source IP address. This could lead to unauthorized access to resources or abuse of service availability controls. The confidentiality impact is limited, and there is no integrity impact reported. Availability impact is low but present due to potential rate limiting bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider disabling the HTTP/3 QUIC module if feasible or implementing additional network-level controls to detect and block IP spoofing. Monitor vendor communications for updates on patches or official mitigations.