CVE-2026-63220: CodeIgniter Framework Spoofable Forwarded HTTPS Headers Vulnerability
Summary
CVE-2026-63220: CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure(). Affects codeigniter4/framework versions < 4.7.4. Fixed in 4.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a powerful PHP framework designed for building web applications. It provides a rich set of libraries and tools that facilitate rapid development while maintaining a small footprint. The framework is widely used for its simplicity and flexibility, allowing developers to create secure and efficient applications. However, it is vulnerable to a specific issue where the IncomingRequest::isSecure() method incorrectly trusts certain HTTP headers, potentially compromising the security of applications relying on HTTPS.
Vulnerability Detail
The vulnerability arises from the IncomingRequest::isSecure() method in CodeIgniter, which trusts the X-Forwarded-Proto and Front-End-Https headers from incoming requests without proper validation. This can allow an attacker to spoof these headers, leading the application to mistakenly treat an insecure HTTP request as secure. The implications are significant, especially for applications that enforce HTTPS-only access or make security-sensitive decisions based on these headers. Exploitability is contingent on deployment configurations, particularly if the backend is accessible over HTTP or if a reverse proxy forwards client-supplied headers without modification.
How To Fix
Minimum fixed version
4.7.4
This is the first release that contains the fix.
composer require codeigniter4/framework:4.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, enforce HTTP-to-HTTPS redirects outside of CodeIgniter. This can be accomplished using server configuration files. For example, in an Apache .htaccess file, you can add the following rules:
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
For Nginx, you can use:
server {
listen 80;
server_name your_domain.com;
return 301 https://$host$request_uri;
}
Conclusion
The CVE-2026-63220 vulnerability in the CodeIgniter framework poses a significant risk by allowing spoofed HTTPS headers, which can mislead applications into treating insecure requests as secure. It is crucial to upgrade to version 4.7.4 or later to mitigate this risk. If immediate upgrades are not possible, implementing server-level redirects can serve as a temporary workaround.
See every vulnerability recorded for codeigniter4/framework →
FAQ
CVE-2026-63220 is a vulnerability in the CodeIgniter framework that allows attackers to spoof HTTPS headers, potentially compromising the security of applications.
If your application relies on the IncomingRequest::isSecure() method for security decisions, it may incorrectly treat insecure requests as secure, leading to potential security breaches.
Versions prior to 4.7.4 are affected by this vulnerability. It is recommended to upgrade to version 4.7.4 or later.
If an upgrade is not possible, implement HTTP-to-HTTPS redirects at the server level to mitigate the risk until you can update the framework.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter4/framework.
