IP Restriction Bypass in simple-php-router by SkipperBent

CVE-2026-103592

What is CVE-2026-103592?

The simple-php-router version through 5.4.1.7 is vulnerable to an IP restriction bypass in its IpRestrictAccess middleware. This weakness enables remote unauthenticated attackers to bypass security measures that use IP whitelists and blacklists. By spoofing headers such as X-Forwarded-For, CF-Connecting-IP, or Client-IP, malicious actors can impersonate trusted IP addresses or circumvent established blacklists, which allows them unauthorized access to sensitive routes intended for limited access only.

References