{"id":"CVE-2026-116254","kind":"vulnerability","aliases":["CVE-2026-116254"],"related":[],"title":"rathena FluxCP: PayPal IPN handler trusts spoofable X-Real-IP header","description":"A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The PayPal IPN handler in rathena FluxCP checks the sender's origin using the X-Real-IP request header, which the client controls. An attacker can forge that header to pass the origin check and send fake payment notifications.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fluxcp","package","paypal","rathena","self-hosted"],"not_affected_if":["endpoint-not-internet-reachable","paypal-ipn-disabled"],"how_to_check":"- Check whether the FluxCP install is at or below commit `98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d` (unknown how to read the version from the sources)\n- Look at `lib/Flux/PaymentNotifyRequest.php` in the function `verifyiprange` to see whether it reads X-Real-IP\n- Confirm whether the PayPal IPN endpoint is publicly reachable","fix":"- Until a fix exists, restrict the PayPal IPN endpoint to PayPal's published IP ranges at the web server or firewall, and ignore X-Real-IP for that check","status":"open","published_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:47+00:00","updated_at":"2026-10-26T10:30:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T10:30:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown. The sources do not name a fixed version, and the vendor did not respond to disclosure.\n- Until a fix exists, restrict the PayPal IPN endpoint to PayPal's published IP ranges at the web server or firewall, and ignore X-Real-IP for that check","reach":"internet","title":"rathena FluxCP: PayPal IPN handler trusts spoofable X-Real-IP header","impact":"medium","summary":"The PayPal IPN handler in rathena FluxCP checks the sender's origin using the X-Real-IP request header, which the client controls. An attacker can forge that header to pass the origin check and send fake payment notifications.","category":"package","nicknames":[],"who_cares":["rathena","fluxcp","self-hosted","paypal"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker forges payment notifications and credits accounts without paying","analyst_note":"Confirm the fixed version or a workaround in the NVD entry and check whether the handler is enabled by default in FluxCP.","how_to_check":"- Check whether the FluxCP install is at or below commit `98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d` (unknown how to read the version from the sources)\n- Look at `lib/Flux/PaymentNotifyRequest.php` in the function `verifyiprange` to see whether it reads X-Real-IP\n- Confirm whether the PayPal IPN endpoint is publicly reachable","needs_analyst":true,"not_affected_if":["paypal-ipn-disabled","endpoint-not-internet-reachable"],"who_is_affected":"Sites running rathena FluxCP with the PayPal IPN handler enabled, where the payment notification endpoint is reachable from the internet. Sites without PayPal payments configured, or with the endpoint blocked from outside, are less exposed. The sources do not say which default configuration enables the handler.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":3411,"output_tokens":702,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116254':15A,18A '-2026':14A,17A '98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d':75C 'affect':78C 'argument':96C 'attack':51B,107C 'avail':119C 'carri':112C 'check':33B,60B 'client':48B 'compon':88C 'contact':127C 'control':49B 'cve':13A,16A 'disclosur':131C 'earli':128C 'error':105C 'exploit':116C 'fake':63B 'file':84C 'fluxcp':2A,19B,32B,72C 'forg':53B 'function':80C 'handler':5A,29B,91C 'header':12A,45B,55B 'host':25B 'identifi':69C 'ip':11A,43B,100C 'ipn':4A,28B,90C 'issu':77C 'lead':101C 'lib/flux/paymentnotifyrequest.php':85C 'manipul':93C 'might':121C 'notif':65B 'origin':37B,59B,103C 'packag':20B 'pass':57B 'payment':64B 'paypal':3A,21B,27B,89C 'possibl':109C 'public':118C 'rathena':1A,22B,31B,71C 'real':10A,42B,99C 'remot':114C 'request':44B 'respond':135C 'self':24B 'self-host':23B 'send':62B 'sender':35B 'spoofabl':7A 'trust':6A 'use':38B,123C 'valid':104C 'vendor':125C 'verifyiprang':81C 'vulner':67C 'way':138C 'x':9A,41B,98C 'x-real-ip':8A,40B,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running rathena FluxCP with the PayPal IPN handler enabled, where the payment notification endpoint is reachable from the internet. Sites without PayPal payments configured, or with the endpoint blocked from outside, are less exposed. The sources do not say which default configuration enables the handler.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116254","severity":null,"published_at":"2026-10-26T10:16:52+00:00","modified_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}