CVE-2026-116254mediumCWE-345CWE-346

CVE-2026-116254: medium-severity vulnerability in rathena FluxCP

rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

Published · Updated

Follow this CVE+ Monitor FluxCP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.3%
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
rathena · FluxCP
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — rathena FluxCP

In the same product, most dangerous first.

CVE-2024-45799HIGHJavascript Injection in Vending Info/Buyers Info Module in FluxCPEPSS 0.3%CVE-2025-62797HIGHCSRF in FluxCP account endpoints allows account takeover / state-changing actionsEPSS 0.2%