Echo’s ExtractIPFromRealIPHeader incorrectly trusts the X-Real-IP header sent by the client rather than verifying that the value comes from a trusted source. As a result, a client can send a loopback or private IP address in the header and cause the application to treat that spoofed address as the true client identity. This can undermine IP‑based allowlists, rate limiting, audit logs, and request forwarding that rely on the extracted IP.

The vulnerability affects LabStack Echo version 5.0.0 up to and including 5.4.0. Versions prior to 5.0.0 and the v4 line, which use the default direct extractor, are not affected. The issue is addressed in Echo v5.4.1 and later.

With a CVSS score of 5.3 and no EPSS data, the likelihood of exploitation is considered moderate. The attack vector is remote, requiring an attacker to forge an X-Real-IP header when contacting an Echo instance directly or through a proxy that preserves the header. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits at this time. However, if an application relies on this header for security controls, the possibility of IP spoofing could lead to unauthorized access or denial‑of‑service conditions.