AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
Summary
The getRealIpAddr() function in objects/functions.php trusts user-controlled HTTP headers to determine the client's IP address.
An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging.
Vulnerable Code
File: objects/functions.php
$headers = [
'HTTP_X_REAL_IP',
'HTTP_CLIENT_IP',
'HTTP_X_FORWARDED_FOR',
'REMOTE_ADDR'
];
foreach ($headers as $header) {
if (!empty($_SERVER[$header])) {
$ips = explode(',', $_SERVER[$header]);
foreach ($ips as $ipCandidate) {
$ipCandidate = trim($ipCandidate);
if (filter_var($ipCandidate, FILTER_VALIDATE_IP,
FILTER_FLAG_IPV4)) {
return $ipCandidate;
}
}
}
}Attack Scenario
- Attacker sends request with forged header:
X-Client-IP: 127.0.0.1or
X-Real-IP: 192.168.1.1getRealIpAddr()returns the forged IP- Any IP-based rate limiting, access control, or audit log that relies on this function is bypassed
Proof of Concept
curl -H "X-Client-IP: 127.0.0.1" \
https://target.com/any_endpoint.phpThe server now believes the request came from localhost.
Impact
- Bypass IP-based rate limiting
- Bypass IP-based access controls
- Forge audit log entries
- Potential privilege escalation if localhost is trusted
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | wwbn/avideo | <= 26.0 | no fix |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-348- Platform
- Composer
- Package
wwbn/avideo- Disclosed
- 25.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8p2x-5cpm-qrqw - CC BY 4.0
Vulnerability history: wwbn/avideo
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 160
- First → latest
- 04.2022 06.2026
- Without a fix
- 143
- Exploited in attacks
- 0
Severity breakdown
- Critical 14
- High 61
- Medium 83
- Low 2
Disclosures per year
- 2022: 2
- 2023: 5
- 2024: 5
- 2025: 0
- 2026: 148
-
AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.