CVE-2024-21494

CVE-2024-21494 is an authentication bypass vulnerability affecting all versions of the greenpau/caddy-security package. It allows an attacker to spoof an IP address via the X-Forwarded-For header due to improper input sanitization, potentially leading to unauthorized access if the system trusts the spoofed IP. This vulnerability has a medium severity CVSS score of 5.4, indicating a network-based attack with low complexity and potential for limited confidentiality and integrity impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.