EUVD-2026-63542Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
AV:N and PR:N because attack is remote and unauthenticated; AC:H because attacker must control a PTR delegation; I:H for complete WAF control bypass; C:N and A:N as no data exfiltration or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.
AnalysisAI
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to be met simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N scores 5.9 (Medium), accurately reflecting that while the attack is fully remote and unauthenticated, exploitation requires non-trivial DNS infrastructure - the attacker must control a reverse DNS delegation for their source IP, typically obtained via a VPS or dedicated hosting provider. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade BunkerWeb to version 1.6.13 or later; this is the vendor-released patch that introduces FCrDNS validation via the get_ips function, confirming that rDNS-resolved hostnames resolve back to the originating client IP before any suffix match is trusted. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in BunkerWeb's UI and API allows a low-privileged authenticated user to inject attacker-controlled
Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today