CVE-2026-116254

MEDIUM 6.5

rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-346 CWE-345
Vendor	rathena
Product	fluxcp
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for rathena fluxcp

Be the first to know when new medium vulnerabilities affecting rathena fluxcp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

rathena / FluxCP

98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/426288 vuldb.com: https://vuldb.com/vuln/426288/cti vuldb.com: https://vuldb.com/cve/CVE-2026-116254 vuldb.com: https://vuldb.com/submit/1009729 gist.github.com: https://gist.github.com/qianqiusujiu/2a57c3721116efc6fe7c20b41ad68a5d

Credits

🔍 qianqiu (VulDB User) VulDB CNA Team