SuggestArr before 3.0.0 contains an authentication bypass in the local_bypass mode. The authentication middleware trusts the client‑controlled request.remote_addr value, which originates from the X‑Forwarded‑For header after the ProxyFix(x_for=1) configuration. By submitting requests with X‑Forwarded‑For set to a trusted CIDR such as 127.0.0.1, an attacker can obtain an unauthenticated admin session through _load_bypass_user_context, gaining full administrative rights to endpoints like /api/users and /api/jobs without providing any credentials. This vulnerability is identified as CWE‑290.

All releases of SuggestArr prior to version 3.0.0 distributed by giuseppe99barchetta are affected. The 3.0.0 release and later versions include a fix that removes the trust in the client‑controlled IP header.

The CVSS score of 9.1 classifies the issue as critical. EPSS is not reported, and the vulnerability is not listed in CISA KEV. The attack vector is a simple HTTP request carrying a spoofed X‑Forwarded‑For header; no credentials or privileged access are required to exploit it, so the exploitation likelihood is high for applications that have ProxyFix enabled and accept the header unfiltered. If the application is exposed directly to the Internet or to untrusted networks, the risk is especially elevated.