CVE-2026-63220
Received Received - Intake

CodeIgniter HTTPS Header Spoofing Vulnerability

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may have impacted applications that rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. Exploitability depends on deployment configuration. Applications are most exposed if the backend is reachable directly over HTTP, or if a reverse proxy/load balancer forwards client-supplied forwarding headers without stripping or overwriting them. This issue has been fixed in version 4.7.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-63220
EUVD
EUVD-2026-51396

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
codeigniter codeigniter to 4.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CodeIgniter versions before 4.7.4 have a vulnerability where the isSecure() method trusts X-Forwarded-Proto and Front-End-Https headers from any request. An attacker can spoof these headers to trick the application into treating an HTTP request as secure. This affects applications relying on isSecure() or similar functions to enforce HTTPS-only access or make security decisions.

Detection Guidance

Check if your CodeIgniter application is running a version prior to 4.7.4. Review server logs for requests with X-Forwarded-Proto or Front-End-Https headers that may indicate header spoofing attempts. Inspect reverse proxy or load balancer configurations to ensure client-supplied forwarding headers are properly sanitized.

Impact Analysis

This vulnerability may allow attackers to bypass HTTPS enforcement, leading to potential exposure of sensitive data transmitted over unencrypted connections. Applications relying on isSecure() for security decisions could be misled into allowing insecure access, increasing risk of data interception or manipulation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations requiring encryption for data in transit. If attackers exploit this to access sensitive data over HTTP, organizations may violate requirements for secure data transmission and face penalties.

Mitigation Strategies

Upgrade CodeIgniter to version 4.7.4 or later. Configure reverse proxies or load balancers to strip or overwrite X-Forwarded-Proto and Front-End-Https headers before forwarding requests to the backend. Ensure applications do not rely solely on these headers for security decisions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart