HTTP Header Spoofing Risk in CodeIgniter Web Framework by CodeIgniter
CVE-2026-63220

4.8MEDIUM

Key Information:

Vendor

Codeigniter4

Status
Codeigniter4
Vendor
CVE Published:
31 July 2026

What is CVE-2026-63220?

The CodeIgniter framework prior to version 4.7.4 is susceptible to HTTP header spoofing due to improper validation of the X-Forwarded-Proto and Front-End-Https headers. This vulnerability may allow attackers to manipulate these headers, leading the application to erroneously recognize non-secure HTTP requests as secure. Applications that utilize methods such as IncomingRequest::isSecure(), force_https(), or similar mechanisms for enforcing secure connections are particularly at risk. The exploitability of this issue is contingent on server configurations, specifically where direct HTTP access is possible or when a reverse proxy forwards unvalidated client-supplied headers. To mitigate this risk, it is crucial to upgrade to version 4.7.4 or later.

Affected Version(s)

CodeIgniter4 < 4.7.4

References

https://github.com/codeigniter4/CodeIgniter4/security/adv...
x_refsource_CONFIRM
https://github.com/codeigniter4/CodeIgniter4/commit/ecbf0...
x_refsource_MISC
https://github.com/codeigniter4/CodeIgniter4/releases/tag...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.