Threats tagged 'ghsa-wchh-mrv2-5h4q'

A vulnerability in github.com/mayswind/ezbookkeeping allows remote attackers to bypass source-IP allowlists configured for MCP and API token access by sending a spoofed X-Forwarded-For header. The application uses the Gin framework without setting trusted proxies, causing it to trust the attacker-supplied header as the client IP. This bypasses IP-based access controls and causes audit logs to record the spoofed IP instead of the attacker's real IP, undermining non-repudiation. The issue affects versions from 0.10.0 up to but not including 1.6.0 and is fixed in version 1.6.0.