IP Spoofing Vulnerability in LibreTranslate Affects Authentication Security

CVE-2026-57942

What is CVE-2026-57942?

LibreTranslate versions up to 1.9.7 expose users to an IP spoofing vulnerability due to inadequate checks on the X-Forwarded-For HTTP header in the get_remote_address() function. This flaw allows unauthenticated attackers to inject arbitrary values, effectively forging client IP addresses. By exploiting this weakness, attackers can circumvent rate limits and flood bans, leading to potential unlimited API abuse. A patch has been introduced in later versions to address this security issue.

References