PoC Archive PoC Archive

tag

Header-Spoofing

  • CVE-2026-20896 web CRITICAL 9.8 EPSS 32%

    Gitea Docker Image Reverse-Proxy Authentication Bypass — "One Header, Any User" (CVE-2026-20896)

    Gitea supports reverse-proxy authentication: put it behind a proxy that sets an X-WEBAUTH-USER header, and Gitea trusts that header for the username, gated by REVERSEPROXYTRUSTEDPROXIES — an IP allowlist meant to ensure only the actual proxy can set that…

    Patched 2026-07-11
  • CVE-2026-35616 network CRITICAL 9.1 KEV EPSS 89%

    Fortinet FortiClient EMS Pre-Auth Bypass — "FortiBleed" (CVE-2026-35616)

    CVE-2026-35616 is a pre-authentication bypass in Fortinet FortiClient EMS's certificate-chain authentication handler (certchainauth.py), which trusts the X-SSL-CLIENT-VERIFY header directly without performing real cryptographic validation of the presented…

    Patched 2026-07-03