Executive brief
CodeIgniter is a popular web application framework. A vulnerability in how it handles secure connection checks allows an attacker to trick the application into thinking an unencrypted (HTTP) request is actually encrypted (HTTPS). This could allow attackers to bypass security rules that require secure connections, potentially leading to unauthorized access or data exposure depending on how the application is configured.
Technical details
The IncomingRequest::isSecure() method in CodeIgniter4 incorrectly trusts 'X-Forwarded-Proto' and 'Front-End-Https' headers from any incoming request without verification. An attacker can spoof these headers to make the application believe a request is secure, bypassing logic in isSecure(), force_https(), or forceGlobalSecureRequests. This is particularly exploitable in environments where the backend is reachable via HTTP and a reverse proxy or load balancer fails to strip or overwrite client-supplied forwarding headers. The issue is classified as CWE-348 (Use of Less Trusted Source) and is fixed in version 4.7.4.
Affected products
- CodeIgniter CodeIgniter4 < 4.7.4
Timeline
- 2026-07-07: disclosed: Initial disclosure by paulbalandan
- 2026-07-31: advisory: NVD publication date
- 2026-08-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Version 4.7.4 released