CVE-2026-63220

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4

Description The IncomingRequest::isSecure() function trusts the X-Forwarded-Proto and Front-End-Https headers from any incoming request. This allows an attacker to spoof these headers, leading the application to incorrectly identify an HTTP request as secure. This issue affects applications using isSecure(), force https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. The risk is higher if the backend is directly reachable via HTTP or if a reverse proxy or load balancer forwards client-supplied headers without stripping or overwriting them.

Recommendations Update to version 4.7.4.