rAthena FluxCP CVE-2026-116254

Exploitation requires a FluxCP instance with the PayPal IPN payment/donation handler in use, where the verifyiprange function in lib/Flux/PaymentNotifyRequest.php validates the request origin against PayPal's IP ranges using the client-controllable X-Real-IP header. The limiting factor is that the application must trust and read X-Real-IP (typical in reverse-proxy deployments) and must have PayPal IPN processing enabled; the trigger is a spoofed X-Real-IP header, and no authentication or user interaction is needed (PR:N/UI:N). Impact is bounded to forging the apparent origin of IPN traffic (VI:L/VA:L), not full account or server compromise.

This is a moderate, not a top-priority, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, unauthenticated, low-complexity flaw, but impact is deliberately scoped as VC:N/VI:L/VA:L - no confidentiality loss and only limited integrity/availability effect, yielding a base score of 5.5 (medium). The flaw is an origin validation error (CWE-346): verifyiprange in the PayPal IPN handler can be fooled by an attacker-supplied X-Real-IP header, so an attacker can make forged IPN traffic appear to originate from PayPal's address range. No EPSS score and no CISA KEV status were provided in the input, so there is no quantitative exploitation-probability signal and no evidence of active exploitation. A public PoC reference exists (a GitHub gist) but it is not verified as working exploit code, so POC availability must not be read as confirmed exploitability. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue. Net: real and remotely triggerable, but the limited technical impact and the niche deployment base keep it below critical priority. Note the vendor did not respond to disclosure and no fixed version is listed, which raises remediation uncertainty.

An attacker sends an HTTP request to a FluxCP installation's PayPal IPN endpoint and sets the X-Real-IP header to a value inside PayPal's expected IP range, defeating the verifyiprange origin check and causing the application to accept a forged Instant Payment Notification. A public PoC reference (GitHub gist) exists but is not verified as working exploit code. Because the vector is network-based and requires no authentication or user interaction, the request can be delivered directly to any reachable instance.