CVE-2026-64797 is an authentication bypass vulnerability (CWE-290) in the IP Login extension for Joomla by regularlabs.com. The extension improperly trusts client-IP headers forwarded in requests without requiring that these headers originate from a trusted proxy. This allows an attacker to spoof the IP address used for automatic login, potentially gaining unauthorized access by impersonating accounts mapped to those IPs. The issue affects versions 1.0.0 through 6.2.5 of the extension. No official patch or remediation guidance is currently available from the vendor.

An attacker can bypass authentication by spoofing the client IP address in the forwarded headers, enabling unauthorized automatic login as users mapped to those IPs. This leads to a high-impact integrity violation by impersonating legitimate accounts without needing valid credentials. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the IP Login extension or restricting access to trusted networks to reduce exposure. Review and configure trusted proxy settings properly if supported by the extension to prevent acceptance of spoofed IP headers.