---
id: "CVE-2026-116254"
kind: "vulnerability"
aliases: ["CVE-2026-116254"]
title: "rathena FluxCP: PayPal IPN handler trusts spoofable X-Real-IP header"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fluxcp", "package", "paypal", "rathena", "self-hosted"]
not_affected_if: ["endpoint-not-internet-reachable", "paypal-ipn-disabled"]
published_at: "2026-10-26T10:16:52+00:00"
first_seen_at: "2026-10-26T10:29:17+00:00"
updated_at: "2026-10-26T10:30:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116254", "first_seen_at": "2026-10-26T10:29:17+00:00"}]
---

# rathena FluxCP: PayPal IPN handler trusts spoofable X-Real-IP header

The PayPal IPN handler in rathena FluxCP checks the sender's origin using the X-Real-IP request header, which the client controls. An attacker can forge that header to pass the origin check and send fake payment notifications.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the FluxCP install is at or below commit `98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d` (unknown how to read the version from the sources)
- Look at `lib/Flux/PaymentNotifyRequest.php` in the function `verifyiprange` to see whether it reads X-Real-IP
- Confirm whether the PayPal IPN endpoint is publicly reachable

## Fix

- Until a fix exists, restrict the PayPal IPN endpoint to PayPal's published IP ranges at the web server or firewall, and ignore X-Real-IP for that check

## Timeline

- 2026-10-26T10:29:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116254

## From the sources

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_