Skip to main content

Ip Login Extension For Joomla CVE-2026-64797

| EUVDEUVD-2026-47815 HIGH
Authentication Bypass by Spoofing (CWE-290)
2026-07-22 Joomla
Authentication Bypass Ip Login Extension For Joomla
7.5
CVSS 3.1 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jul 28, 2026 - 18:30 vuln.today
CVSS changed
Jul 28, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
Jul 22, 2026 - 20:44 cve.org
HIGH 7.5
CVE Published
Jul 22, 2026 - 20:44 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.

AnalysisAI

Authentication bypass via IP spoofing in the IP Login extension for Joomla allows unauthenticated attackers to impersonate mapped accounts. The extension trusts forwarded client-IP headers without requiring a trusted proxy, enabling remote attackers to spoof the IP used for automatic login. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ip Login Extension For Joomla

View all
CVE-2026-64798 CRITICAL
9.1 Jul 22

Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise account
CVE-2026-63265 HIGH
8.0 Jul 22

We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged R

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-64797 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy