CVE-2026-64875: GeoIP Auth Bypass Vulnerability

CVE-2026-64875 Overview

CVE-2026-64875 describes a security control bypass in which GeoIP lookups trust spoofable forwarded client-IP headers. The flaw is categorized under [CWE-290] Authentication Bypass by Spoofing. An attacker who controls HTTP request headers such as X-Forwarded-For or X-Real-IP can influence the source IP used for geolocation. This causes GeoIP-based access rules, allow lists, and country blocks to be evaluated against attacker-supplied data rather than the actual remote address.

Critical Impact
Attackers can bypass GeoIP-based access control rules by forging client-IP headers, allowing traffic from restricted regions to reach protected resources.

Affected Products

Product details are not enumerated in the current advisory. Refer to the Regular Labs Security Overview for vendor-specific information.

Discovery Timeline

2026-07-23 - CVE-2026-64875 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64875

Vulnerability Analysis

The vulnerability resides in the GeoIP lookup logic used to enforce geographic access rules. Instead of resolving the client location from the TCP peer address, the implementation reads forwarded headers such as X-Forwarded-For, X-Real-IP, or Forwarded and passes the value directly to the GeoIP resolver. These headers are user-controlled input on any request that does not originate from a trusted, correctly configured reverse proxy.

Because the GeoIP decision drives allow or deny logic, an attacker can select an arbitrary source country by choosing an IP address that resolves to that country in the GeoIP database. The security boundary that administrators believe they have configured therefore does not exist for direct requests or requests through proxies that do not strip these headers.

Root Cause

The root cause is trust of unauthenticated request metadata. Forwarded client-IP headers are advisory and must only be honored when the immediate connection originates from a known and trusted proxy. The affected code applies no such validation before using the header value for a security-relevant lookup, matching the [CWE-290] pattern of authentication or authorization bypass via spoofed identifiers.

Attack Vector

An attacker sends an HTTP request that includes a crafted X-Forwarded-For header containing an IP address in an allowed country. The application resolves that address to the permitted region and grants access, bypassing the GeoIP rule. No authentication is required, and the attack requires only the ability to send arbitrary HTTP headers. The technique also enables evasion of logging, rate limiting, and fraud controls that rely on GeoIP data. See the Regular Labs Security Overview for further vendor context.

Detection Methods for CVE-2026-64875

Indicators of Compromise

Requests containing X-Forwarded-For, X-Real-IP, or Forwarded headers received directly from external clients rather than from a trusted reverse proxy.
Access log entries where the logged client IP differs materially from the TCP peer address recorded by the load balancer or web server.
Successful access to resources protected by a country-block rule from IP ranges outside the permitted geography.

Detection Strategies

Compare the TCP peer address against the value used for GeoIP lookups and alert when they resolve to different countries.
Inspect inbound traffic for forwarded headers containing multiple IPs, private ranges, or values from geographies that do not match the network path.
Correlate authentication events with GeoIP-decision logs to surface requests where the decision input was header-derived.

Monitoring Recommendations

Enable full HTTP header logging at the edge so both the peer address and forwarded headers are preserved for review.
Baseline the expected proxy chain and alert when unexpected upstream addresses appear in the forwarded chain.
Feed web server, WAF, and application logs into a centralized analytics platform to detect country-rule bypass patterns over time.

How to Mitigate CVE-2026-64875

Immediate Actions Required

Reconfigure the application to derive the client IP from the TCP peer address rather than untrusted headers.
Restrict acceptance of X-Forwarded-For and Forwarded headers to requests arriving from an explicit list of trusted proxy addresses.
Audit existing GeoIP rules and review recent access logs for evidence of header-based bypass.

Patch Information

A specific patched version is not enumerated in the published NVD entry. Administrators should monitor the Regular Labs Security Overview for vendor updates and apply any released fixes that harden the GeoIP resolution path.

Workarounds

Terminate TLS on a reverse proxy or WAF that overwrites forwarded client-IP headers with the verified peer address before the request reaches the application.
Strip or normalize inbound X-Forwarded-For, X-Real-IP, and Forwarded headers at the network edge when the source is not a trusted proxy.
Enforce country-based access decisions at the WAF or CDN layer, where the true client address is authoritative, rather than inside the application.

bash

# Example: strip untrusted forwarded headers at an nginx edge
server {
    listen 443 ssl;

    # Remove client-supplied forwarding headers
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_set_header Forwarded       "";

    # Only honor forwarded headers from known proxies
    set_real_ip_from 10.0.0.0/8;
    real_ip_header   X-Forwarded-For;
    real_ip_recursive on;

    location / {
        proxy_pass http://backend;
    }
}