Mega Fence Project

mega-fence_project

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Mega Fence

mega-fence

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-65328 1Mega Fence Project 1Mega Fence Jun 17, 2026 Jan 5, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Mega-Fence (webgate-lib.) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remot...Show more Mega-Fence (webgate-lib.) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remote request to spoof the client IP, which is then propagated to security-relevant state (e.g., WG_CLIENT_IP cookie). Deployments that rely on this value for IP allowlists may be bypassed.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2025-65328

1Mega Fence Project

1Mega Fence

Jun 17, 2026

Jan 5, 2026

N/A· v4

6.5 MEDIUM· v3

N/A· v2

Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain. An attacker can supply an arbitrary XFF value in a remote request to spoof the client IP, which is then propagated to security-relevant state (e.g., WG_CLIENT_IP cookie). Deployments that rely on this value for IP allowlists may be bypassed.Show less