HestiaCP versions 1.2.0 through 1.9.4 can be tricked into accepting an arbitrary CF-Connecting-IP header value when verifying user authentication. This allows an unauthenticated attacker to convince the system that a request comes from a trusted IP address, thereby bypassing authentication controls, disabling fail2ban protections, evading per‑user IP allowlists, and corrupting audit logs. The weakness is classified as CWE‑348, a type of spoofing flaw that permits malicious actors to masquerade as legitimate network addresses.

The vulnerability affects HestiaCP installations running any version between 1.2.0 and 1.9.4 inclusive. Systems maintain a web‑based control panel and rely on the CF-Connecting-IP header to determine the client IP for authentication and auditing purposes.

The CVSS score of 8.7 indicates a high severity for this flaw. The EPSS score is not available, so the current probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending crafted HTTP requests with a manipulated CF-Connecting-IP header over the Internet, assuming they can reach the HestiaCP service. No authentication or privileged credentials are required; the vulnerability is exploitable from outside the target network.