CVE-2026-77463

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology.

• CWE-348
• CWE-807

• https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39
• https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab
• https://github.com/umputun/remark42/pull/2116
• https://github.com/umputun/remark42/pull/2118
• https://github.com/umputun/remark42/releases/tag/backend/v1.16.2
• https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27
• https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7744A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3
• CVE-2026-7745A vulnerability was determined in CodeAstro Online Classroom…6.3
• CVE-2026-77454Incorrect Authorization vulnerability in ash-project ash_sql…5.9
• CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool fo…9.9
• CVE-2026-7746A vulnerability was identified in SourceCodester Web-based P…6.3
• CVE-2026-77460EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-77465toml-node is a TOML parser for Node.js and the browser. Prio…7.5
• CVE-2026-77466Lychee is a free, open-source photo-management tool. Prior t…8.3
• CVE-2026-77467Lychee is a free, open-source photo-management tool. Prior t…7.1
• CVE-2026-77468Lychee is a free, open-source photo-management tool. Prior t…6.9
• CVE-2026-7747A security flaw has been discovered in Totolink N300RH 3.2.4…9.8
• CVE-2026-77470Lychee is a free, open-source photo-management tool. Prior t…8.3