Executive brief
The IP Login extension for Joomla, which allows users to be automatically logged into a website based on their network address, contains a security flaw in how it identifies visitors. Because the software incorrectly trusts certain network headers without verification, an attacker can fake their identity to match a recognized address. This could allow an unauthorized person to gain automatic access to user accounts without providing a password.
Technical details
A vulnerability exists in the Regular Labs IP Login extension for Joomla (versions 1.0.0 through 6.2.5) due to improper validation of forwarded client-IP headers. The extension trusts 'X-Forwarded-For' or similar headers even when no trusted proxy has been configured. An attacker can exploit this by sending a specially crafted HTTP request with a spoofed IP header that matches a pre-configured 'trusted' IP address. This results in an authentication bypass (CWE-290), allowing the attacker to be automatically logged in as the user account mapped to that specific IP address.
Affected products
- Regular Labs IP Login extension for Joomla 1.0.0 through 6.2.5
Timeline
- 2026-07-22: disclosed: CVE published by Joomla! Project