CVE-2026-34025: Wertheim SafeController Auth Bypass Flaw

CVE-2026-34025 Overview

CVE-2026-34025 is an authentication bypass vulnerability in Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014. The application enforces branch-level IP restrictions during login but derives the client IP address from the X-Forwarded-For HTTP header when present. An attacker with valid branch user credentials can spoof the expected branch IP by injecting an arbitrary value into the X-Forwarded-For header. This results in a valid authenticated session originating from an unauthorized network location. The flaw is categorized under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
An authenticated attacker can bypass branch IP allowlisting by manipulating a single HTTP header, defeating a key network-based access control on safe management software.

Affected Products

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014
Deployments relying on branch IP restrictions for SafeController logins
Environments where SafeController is reachable through a reverse proxy or load balancer

Discovery Timeline

2026-06-15 - CVE-2026-34025 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34025

Vulnerability Analysis

The Wertheim SafeController Software restricts user authentication based on the source IP address of the login request. Each branch user is bound to an expected IP address representing the branch location. During the login flow, the application determines the client IP by reading the X-Forwarded-For HTTP header when it is included in the request. The application trusts this header without validating that the request actually traversed a trusted reverse proxy.

Because X-Forwarded-For is fully attacker-controlled in any direct HTTP request, an authenticated branch user can inject the expected branch IP into this header. The IP allowlist check then passes, and the server issues a valid session token. The vulnerability does not require elevated privileges beyond a working branch account and does not require user interaction.

Root Cause

The root cause is improper trust of a client-supplied HTTP header for security-sensitive IP enforcement. The application should determine the client IP from the TCP connection metadata or only honor X-Forwarded-For when the request arrives from a known trusted proxy. Treating the header as authoritative collapses the IP-based access control into a check the client itself controls.

Attack Vector

Exploitation requires network access to the SafeController login endpoint and possession of valid branch user credentials. The attacker sends a standard login request and adds an X-Forwarded-For header containing the IP address associated with the targeted branch. The server accepts the spoofed IP, evaluates it against the branch allowlist, and returns an authenticated session. The attacker then operates from any network location while appearing to originate from the legitimate branch.

No verified exploit code is published. Technical details are documented in the Sec-Consult Security Report.

Detection Methods for CVE-2026-34025

Indicators of Compromise

Login requests to SafeController containing an X-Forwarded-For header when the deployment does not sit behind a reverse proxy
Successful authentications where the TCP source IP differs from the IP value present in X-Forwarded-For
Branch user sessions originating from public or non-corporate source IPs at the network edge
Repeated login attempts with varying X-Forwarded-For values targeting the same account

Detection Strategies

Inspect web server, WAF, and reverse proxy access logs for X-Forwarded-For headers on requests reaching the SafeController login endpoint directly
Correlate authenticated session IPs reported by SafeController against the true TCP peer IP captured by upstream network devices
Alert when a branch account authenticates from a source ASN or geolocation inconsistent with its assigned branch

Monitoring Recommendations

Forward SafeController authentication logs and proxy logs into a centralized SIEM for cross-source correlation
Baseline normal login source IPs per branch user and flag deviations
Monitor for header injection patterns such as multiple comma-separated IPs in X-Forwarded-For on login requests

How to Mitigate CVE-2026-34025

Immediate Actions Required

Contact Wertheim for a fixed SafeController build and apply it once available
Place SafeController behind a reverse proxy configured to strip or overwrite inbound X-Forwarded-For headers from untrusted clients
Rotate credentials for any branch accounts that may have authenticated from anomalous source IPs
Restrict network access to the SafeController login interface to known branch network ranges at the firewall layer

Patch Information

No vendor patch identifier is listed in the NVD entry at the time of publication. Refer to the Sec-Consult Security Report and the Wertheim Safes Management Guide for vendor coordination details and updates.

Workarounds

Enforce IP restrictions at the network perimeter using firewall rules rather than relying solely on application-layer checks
Configure the upstream reverse proxy to set X-Forwarded-For to the true TCP peer IP and reject client-supplied values
Require multi-factor authentication for branch users so that a spoofed IP alone does not yield a valid session
Disable or ignore X-Forwarded-For processing in SafeController when the application is exposed directly to clients

bash

# Example nginx configuration to overwrite client-supplied X-Forwarded-For
# before proxying requests to the SafeController backend
location / {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_pass http://safecontroller_backend;
}