CVE-2026-50755 describes a critical security vulnerability in DayuanJiang next-ai-draw-io version 0.4.13. The issue allows a remote attacker to leverage the X-Forwarded-For HTTP header to gain unauthorized access to sensitive information. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has a CVSS v3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability. There is no available patch or official remediation guidance at this time.

Successful exploitation of this vulnerability can lead to full compromise of sensitive information, potentially allowing attackers to bypass authentication mechanisms by spoofing the X-Forwarded-For header. The critical CVSS score indicates that confidentiality, integrity, and availability of the affected system can be fully impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to monitor for updates from the vendor and consider implementing network-level controls to validate or restrict X-Forwarded-For header values if feasible.