CVE-2026-63220: 
PHP vulnerability analysis and mitigation

CVE-2026-63220 is a security feature bypass vulnerability in CodeIgniter4 (the PHP full-stack web framework) caused by spoofable forwarded HTTPS headers in the IncomingRequest::isSecure() method. All versions of codeigniter4/framework prior to 4.7.4 are affected. The vulnerability was published on July 31, 2026, with the GitHub Advisory (GHSA-7wmf-pw8j-mc78) reviewed on August 7, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) (Github Advisory).

The root cause is classified as CWE-348 (Use of Less Trusted Source): IncomingRequest::isSecure() unconditionally trusted the client-supplied X-Forwarded-Proto and Front-End-Https HTTP headers without verifying that the request originated from a configured trusted proxy. An unauthenticated network attacker can craft an HTTP request containing a spoofed X-Forwarded-Proto: https or Front-End-Https: on header, causing the application to evaluate the connection as secure. The fix (commit ecbf044) introduces an isFromTrustedProxy() check that validates the request's REMOTE_ADDR against the configured Config\App::$proxyIPs list before honoring these headers; if the source IP is not a trusted proxy, the headers are ignored (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to trick the application into treating an insecure HTTP connection as HTTPS, potentially bypassing HTTPS-only enforcement logic implemented via isSecure(), force_https(), or forceGlobalSecureRequests. This can lead to low-impact confidentiality and integrity consequences — for example, sensitive data being transmitted or processed over unencrypted channels, or security-sensitive application decisions (such as cookie security flags or access control checks) being made incorrectly. Availability is not impacted, and the scope is unchanged (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.135% (3rd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitability is highly dependent on deployment configuration — applications are most at risk when the backend is directly reachable over HTTP or when a reverse proxy forwards client-supplied forwarding headers without stripping them.

1. Identify a vulnerable target: Locate a CodeIgniter4 application (version < 4.7.4) where the backend is reachable directly over HTTP, or where a reverse proxy/load balancer does not strip client-supplied X-Forwarded-Proto or Front-End-Https headers.
2. Craft a spoofed HTTP request: Construct an HTTP request to the target application that includes one or both of the following headers: X-Forwarded-Proto: https or Front-End-Https: on.
3. Send the request: Deliver the crafted request directly to the backend over plain HTTP (e.g., using curl -H 'X-Forwarded-Proto: https' http://target-app/protected-endpoint).
4. Bypass HTTPS enforcement: The vulnerable isSecure() method returns true based on the spoofed header, causing the application to treat the connection as secure and skip any HTTP-to-HTTPS redirect or HTTPS-only access control logic.
5. Achieve objective: Depending on application logic, the attacker may now access HTTPS-restricted resources over HTTP, suppress secure cookie flags, or manipulate other security-sensitive decisions that rely on the connection security status (Github Advisory, Patch Commit).

• Network: Unexpected HTTP (non-TLS) requests to endpoints that should only be accessible over HTTPS; HTTP requests containing X-Forwarded-Proto: https or Front-End-Https: on headers originating from untrusted or external IP addresses.
• Logs: Web server or application access logs showing HTTP requests (port 80) to HTTPS-restricted routes that were not redirected; log entries where X-Forwarded-Proto or Front-End-Https headers are present in requests from non-proxy source IPs.
• Application Behavior: Absence of expected HTTP-to-HTTPS redirects for requests that should have been redirected; secure cookies being set without the Secure flag on HTTP connections.

Upgrade codeigniter4/framework to version 4.7.4 or later, which validates forwarded HTTPS headers against the configured trusted proxy list (Config\App::$proxyIPs) before honoring them (Github Advisory, v4.7.4 Release). For applications that cannot upgrade immediately, two workarounds should be applied: (1) configure reverse proxies (Apache, nginx, Caddy, or load balancers) to strip or overwrite client-supplied X-Forwarded-Proto and Front-End-Https headers before forwarding requests to the application; and (2) enforce HTTP-to-HTTPS redirects at the web server or load balancer level rather than relying on CodeIgniter's application-layer logic.

The advisory was published by CodeIgniter4 maintainer paulbalandan on July 7, 2026, with credit to reporter gr8man for discovering the issue (Github Advisory). The v4.7.4 release received positive community engagement on GitHub, with 20 reactions including thumbs up, rocket, and heart emojis from community members (v4.7.4 Release). Coverage was picked up by security aggregators including SecurityOnline, INCIBE-CERT, and Tenable (Nessus plugin 331440), indicating routine industry awareness without significant alarm given the moderate severity rating.