Live › vulnerability › CVE-2026-116254
Go to dashboardThe PayPal IPN handler in rathena FluxCP checks the sender's origin using the X-Real-IP request header, which the client controls. An attacker can forge that header to pass the origin check and send fake payment notifications.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running rathena FluxCP with the PayPal IPN handler enabled, where the payment notification endpoint is reachable from the internet. Sites without PayPal payments configured, or with the endpoint blocked from outside, are less exposed. The sources do not say which default configuration enables the handler.
No product ranges from the sources yet.
98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d (unknown how to read the version from the sources)lib/Flux/PaymentNotifyRequest.php in the function verifyiprange to see whether it reads X-Real-IPEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116254")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.