CVE-2026-116254 in FluxCP
Summary
by MITRE • 10/26/2026
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability resides within the PayPal IPN Handler component of Rathena FluxCP, specifically affecting versions up to commit 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This security flaw is located in the verifyiprange function within the lib/Flux/PaymentNotifyRequest.php file. The core technical issue stems from an origin validation error where the application fails to properly sanitize or validate input derived from the X-Real-IP HTTP header. In web architectures that sit behind reverse proxies or load balancers, it is common practice for these intermediary devices to populate the X-Real-IP header with the client's actual source address while setting the standard REMOTE_ADDR variable to the proxy's IP. However, this implementation incorrectly trusts the value provided in the X-Real-IP header without sufficient verification that the request actually originated from a trusted internal proxy. This lack of strict origin validation allows an attacker to spoof their apparent source IP by manipulating this specific HTTP header during transmission.
From a technical perspective, this flaw represents a classic case of insecure direct object references or improper input validation leading to authentication bypass mechanisms. By injecting arbitrary values into the X-Real-IP field, an adversary can trick the verifyiprange function into believing that incoming requests are coming from trusted internal networks or whitelisted IP ranges. This misconfiguration effectively neutralizes any access control measures that rely on IP-based filtering for payment notification endpoints. Since PayPal Instant Payment Notification (IPN) handlers often process sensitive financial data and trigger state-changing actions such as updating user account statuses or granting in-game currency, bypassing these checks can have severe consequences. The vulnerability is classified under CWE-287, which covers Improper Authentication, specifically relating to the failure to correctly verify identity based on network location indicators that are easily spoofed over a network connection.
The operational impact of this vulnerability is significant due to its remote exploitability and the nature of the affected component. Because the PayPal IPN system is designed to accept asynchronous notifications from external payment processors like PayPal, it must be accessible via public networks. An attacker can leverage publicly available exploits to send crafted HTTP requests with manipulated X-Real-IP headers directly to this endpoint. Successful exploitation allows an unauthorized actor to bypass security controls intended to restrict access to the IPN handler. This could lead to fraudulent transactions being processed as legitimate, allowing attackers to obtain in-game items or currency without payment, thereby disrupting the economic balance of the game and causing financial loss for server operators who may be liable for refunds or chargebacks associated with these fraudulent activities.
This issue aligns with MITRE ATT&CK technique T1621, which involves Abuse of Elevation Control Mechanism, as well as aspects of T1078, Valid Accounts, if the bypass allows access to administrative functions tied to payment processing. The persistence of this vulnerability is exacerbated by the vendor's lack of response to early disclosure attempts. Without an official patch or update from the maintainers, system administrators and server operators are left with limited options for remediation within the software itself. Consequently, mitigation strategies must focus on defensive configurations at the network perimeter level rather than relying solely on application-level fixes.
To mitigate this risk in the absence of a vendor-provided fix, organizations should implement strict input validation and header sanitization rules at the web server or reverse proxy layer before requests reach the FluxCP application. Specifically, administrators should configure their infrastructure to ignore any X-Real-IP headers sent by external clients and only accept them from known internal proxy IPs. Additionally, implementing Web Application Firewall (WAF) rules that detect and block anomalous IP header manipulations can provide a critical layer of defense. It is also advisable to review the PayPal IPN handler configuration to ensure that it does not rely exclusively on IP-based trust for security decisions, as this pattern is inherently fragile in distributed web environments where headers are easily manipulated by remote actors.