CVE-2026-54478 describes an authentication bypass vulnerability in NLnet Labs Unbound DNS resolver versions 1.18.0 up to and including 1.25.1. When Unbound listens on a proxy-protocol-port interface with the 'answer-cookie: yes' setting, it computes the RFC 9018 server cookie using the proxy's wire address instead of the PROXYv2-declared client address. Consequently, a server cookie obtained through a proxy node is valid for all clients behind that proxy. An off-path attacker can exploit this by harvesting a valid cookie with a legitimate query and then replaying it with any spoofed source address behind the same proxy, bypassing DNS Cookie protections designed to prevent such spoofing.

The vulnerability allows an attacker to bypass DNS Cookie authentication checks by replaying a valid server cookie for any spoofed client address behind a proxy node. This undermines the DNS Cookie mechanism intended to prevent spoofing and may facilitate spoofed DNS queries or responses. The CVSS score is 3.7 (low), reflecting limited impact and the requirement for specific network conditions (proxy-protocol-port with answer-cookie enabled). There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a fix is available, consider disabling 'answer-cookie: yes' on proxy-protocol-port interfaces or avoid using proxy-protocol with Unbound in affected versions. Monitor NLnet Labs advisories for updates and apply patches once released.