CVE-2026-57942
LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.28%
- CWE
- CWE-348
- Published
- 2026-06-29
- Last modified
- 2026-06-30
Affected products
- LibreTranslate LibreTranslate
- LibreTranslate LibreTranslate
Weakness type
Related vulnerabilities
- CVE-2026-16272 — Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
- CVE-2026-16732 — fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
- CVE-2026-25552 — Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
- CVE-2026-63220 — CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
- CVE-2026-50243 — 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL
- CVE-2026-63770 — Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass
- CVE-2026-64619 — FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers
- CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass