What is the CVSS score of CVE-2026-50755?

CVE-2026-50755 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of next-ai-draw-io are affected by CVE-2026-50755?

DayuanJiang next-ai-draw-io 0.4.13 contains a critical vulnerability (CVE-2026-50755, CVSS 9.8) that allows remote attackers to bypass IP-based access controls and access sensitive information by…

How to fix or mitigate CVE-2026-50755?

Within 24 hours: identify all deployments of next-ai-draw-io 0.4.13 and assess whether IP-based access controls are active; review recent access logs for suspicious client address spoofing; restrict network access to the application to trusted networks only. Within 7 days: deploy a Web Application Firewall (WAF) or reverse proxy to validate client address headers and reject spoofed traffic; maintain detailed audit logs of all connection attempts. Within 30 days: monitor the DayuanJiang project repository for security patches and prepare an upgrade plan; develop and test a migration strategy in staging environment; execute deployment of patched version once available.

next-ai-draw-io CVE-2026-50755

CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-07-21 mitre

Authentication Bypass N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated header spoofing with low complexity yields AV:N/AC:L/PR:N/UI:N; description limits impact to information disclosure, so C:H but I:N/A:N, unlike the inflated 9.8 input.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:34 vuln.today

CVSS changed

Jul 22, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 21, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 21, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value

AnalysisAI

Sensitive information disclosure in DayuanJiang next-ai-draw-io 0.4.13 lets a remote attacker spoof the X-Forwarded-For HTTP header to impersonate a trusted client address and bypass IP-based access controls, exposing protected data. The flaw is classified as authentication bypass by spoofing (CWE-290) and, per the CVSS vector, requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.22%.

Technical ContextAI

next-ai-draw-io is an open-source, Next.js-based web application that pairs an AI assistant with a draw.io diagramming canvas. The root cause is CWE-290 (Authentication Bypass by Spoofing): the application appears to trust the client-supplied X-Forwarded-For header as an authoritative source of the requester's IP address. X-Forwarded-For is a proxy-added, freely user-controllable header, so any logic that uses it to authorize access, whitelist internal callers, or gate sensitive endpoints can be defeated by simply setting the header to an expected value. The supplied CPE is a placeholder (cpe:2.3:a:n/a:n/a:*:*...) and does not enumerate the real product, so affected-product identification here rests on the description rather than NVD CPE data.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so no exact upgrade target can be cited. The primary compensating control is to stop trusting the client-supplied X-Forwarded-For header for any authentication or access-control decision: terminate connections behind a reverse proxy (e.g., nginx) that overwrites X-Forwarded-For with the real socket peer address rather than appending to it, and configure the app to read only the trusted proxy's value or the raw connection IP. Where feasible, enforce access control at the proxy/network layer (block direct access to the app port, require real authentication instead of IP allowlisting) so header spoofing cannot substitute for identity; the trade-off is added proxy configuration and potential breakage of legitimate multi-hop proxy setups. Monitor the issue at https://github.com/DayuanJiang/next-ai-draw-io/issues/750 and the writeup at https://github.com/August829/Yu/blob/main/CVE-2026-50755.md for a released fix, and upgrade once the maintainer publishes a patched version.