This flaw allows an attacker to subvert calibre’s content‑server login protection by injecting a forged X‑Forwarded‑For header. Because the header is accepted without validation, the ban key that should block repeated login attempts does not change when the apparent IP address changes, thus disabling the protection. The issue aligns with CWE‑307 and CWE‑346 and carries a CVSS base score of 5.3, indicating a moderate risk that could lead to credential compromise if left unaddressed.

The vulnerability affects the calibre e‑book manager (vendor kovidgoyal) and applies to all releases older than version 9.4.0. Targeted systems are servers running calibre’s content server that are exposed to the Internet.

With an EPSS score below 1 % the statewide likelihood of exploitation is low, yet the flaw is directly exploitable by any remote user simply by altering an HTTP header. The vulnerability is not listed in CISA’s KEV catalog, but attackers can repeatedly attempt password stuffing once a ban is triggered, making it particularly dangerous for publicly reachable calibre servers.