The flaw occurs when an attacker sends a request containing an X-Forwarded-Host header set to 127.0.0.1:8080. Caido’s 8080 service checks for non-whitelisted domains, but this header bypasses that check, making the request appear to originate from localhost. The result is that an attacker can use the service as if they were an internal client, potentially exposing functionality or data that should only be available to trusted internal traffic. The weakness is an authentication bypass (CWE‑290).

Caido, versions earlier than 0.55.0, shipping with the 8080‑port domain‑whitelisting logic. All releases before 0.55.0 are vulnerable.

CVSS score of 8.1 indicates high severity. EPSS score < 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV data. The bug is exploitable remotely by sending a crafted HTTP request with the X-Forwarded-Host header; no authentication is required. Attackers could connect to Caido as if from the loopback interface and gain access to restricted endpoints.