# CVE-2026-63220: CodeIgniter CodeIgniter4 header spoofing in IncomingRequest::isSecure

Source: https://junglewise.ai/threats/cve-2026-63220-codeigniter-codeigniter4-header-spoofing-in-incomingrequest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

CVE-2026-63220 · Severity: medium · CVSS 4.8 · Published 2026-07-31

CodeIgniter is a popular web application framework. A vulnerability in how it handles secure connection checks allows an attacker to trick the application into thinking an unencrypted (HTTP) request is actually encrypted (HTTPS). This could allow attackers to bypass security rules that require secure connections, potentially leading to unauthorized access or data exposure depending on how the application is configured.

Technologies: [codeigniter4/framework (Packagist)](https://junglewise.ai/threats/technologies/codeigniter4-framework). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-63220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63220 being exploited in the wild.

**How severe is CVE-2026-63220?** Medium severity, with a CVSS score of 4.8, published 31 July 2026.

**Which products and versions are affected?** codeigniter4/framework (Packagist) < 4.7.4, ECOSYSTEM:introduced=0,fixed=4.7.4.

**Is there a fix for CVE-2026-63220?** Yes. codeigniter4/framework (Packagist): upgrade to 4.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63220 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63220?** Check whether you run codeigniter4/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- codeigniter4/framework (Packagist): upgrade to 4.7.4 or later

  ```sh
  composer require codeigniter4/framework:^4.7.4
  ```


## Technical details

The IncomingRequest::isSecure() method in CodeIgniter4 incorrectly trusts 'X-Forwarded-Proto' and 'Front-End-Https' headers from any incoming request without verification. An attacker can spoof these headers to make the application believe a request is secure, bypassing logic in isSecure(), force_https(), or forceGlobalSecureRequests. This is particularly exploitable in environments where the backend is reachable via HTTP and a reverse proxy or load balancer fails to strip or overwrite client-supplied forwarding headers. The issue is classified as CWE-348 (Use of Less Trusted Source) and is fixed in version 4.7.4.

## Affected products

- CodeIgniter CodeIgniter4 < 4.7.4

## Identifiers

- CVE-2026-63220
- GHSA-7wmf-pw8j-mc78

## Timeline

- 2026-07-07: disclosed: Initial disclosure by paulbalandan
- 2026-07-31: advisory: NVD publication date
- 2026-08-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Version 4.7.4 released

## References

- [https://api.github.com/users/gr8man](https://api.github.com/users/gr8man)
- [https://github.com/gr8man](https://github.com/gr8man)
- [https://api.github.com/users/gr8man/gists%7B/gist_id%7D](https://api.github.com/users/gr8man/gists%7B/gist_id%7D)
- [https://api.github.com/users/gr8man/repos](https://api.github.com/users/gr8man/repos)
- [https://avatars.githubusercontent.com/u/5325117?v=4](https://avatars.githubusercontent.com/u/5325117?v=4)
- [https://api.github.com/users/gr8man/events%7B/privacy%7D](https://api.github.com/users/gr8man/events%7B/privacy%7D)

## Related threats

- [CodeIgniter CodeIgniter4 unrestricted file upload in is_image and mime_in rules](https://junglewise.ai/threats/cve-2026-63223-codeigniter-codeigniter4-unrestricted-file-upload-in-is-image-and)
- [CodeIgniter Path Traversal in UploadedFile move method](https://junglewise.ai/threats/cve-2026-63222-codeigniter-path-traversal-in-uploadedfile-move-method)
- [CodeIgniter SQL injection in Query Builder deleteBatch](https://junglewise.ai/threats/cve-2026-63221-codeigniter-sql-injection-in-query-builder-deletebatch)
- [CodeIgniter CodeIgniter4 file upload validation bypass in ext_in rule](https://junglewise.ai/threats/cve-2026-48062-codeigniter-codeigniter4-file-upload-validation-bypass-in-ext-in)
- [CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability](https://junglewise.ai/threats/cve-2025-54418-codeigniter4-s-imagemagick-handler-has-command-injection)