CVE-2026-103592

Name of the Vulnerable Software and Affected Versions simple-php-router versions prior to 5.4.1.8

Description The IpRestrictAccess middleware contains a flaw that allows remote unauthenticated attackers to bypass IP whitelist and blacklist protections. By spoofing the X-Forwarded-For, CF-Connecting-IP, or Client-IP headers, an attacker can impersonate whitelisted addresses or evade blacklists to gain unauthorized access to IP-restricted routes.

Recommendations Update simple-php-router to version 5.4.1.8 or later.