CVE-2025-59101

The record

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.

Affected packages

Related vulnerabilities

• CVE-2026-86485 In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged… CWE-291
• CVE-2026-3690 OpenClaw Canvas Authentication Bypass Vulnerability. CWE-291
• CVE-2026-4252 A vulnerability was identified in Tenda AC8 16.03.50.11. CWE-291
• GHSA-vvjh-f6p9-5vcf OpenClaw Canvas Authentication Bypass Vulnerability CWE-291
• CVE-2025-66602 A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. CWE-291