CVE-2026-108555
Received Received - Intake

IP Spoofing in PairDrop Discovery Rooms

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: VulnCheck

Description
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-108555
EUVD
EUVD-2026-96349

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
schlagmichdoch PairDrop 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PairDrop through 1.11.2 has an IP spoofing vulnerability in Peer._setIP. Attackers can forge the cf-connecting-ip header to join other networks' discovery rooms. This allows them to appear as a local device on self-hosted instances not behind Cloudflare, enabling file transfers with victims.

Detection Guidance

To detect this vulnerability, monitor WebSocket connections for forged cf-connecting-ip headers. Check if PairDrop instances are behind Cloudflare by verifying header handling. Inspect logs for unexpected IP-based room entries or connections from unknown public IPs.

Impact Analysis

If you use PairDrop 1.11.2 or earlier, an attacker knowing your public IP could impersonate a local device on your network. This could allow them to send or receive files from your device without your knowledge, potentially leading to data theft or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance breaches if sensitive data is exposed due to this flaw.

Mitigation Strategies

Update PairDrop to the latest version beyond 1.11.2 to address the IP spoofing flaw. If self-hosting, ensure Cloudflare is properly configured to filter incoming requests and validate headers. Monitor network traffic for unusual connections from public IPs claiming to be local devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart