The flaw arises when Unbound listens on a proxy‑protocol‑port and has the answer‑cookie option enabled. It builds the RFC 9018 server‑cookie SipHash key using the proxy’s wire address instead of the actual PROXYv2‑declared client address. Consequently, a cookie obtained via a legitimate query on a given proxy node validates for any proxied source behind that node. An off‑path attacker can therefore capture a single cookie, replay it from any spoofed source, and bypass DNS Cookie checks that were intended to defend against spoofed DNS responses. The vulnerability represents an authorization bypass (CWE‑290) that enables forged DNS responses to be accepted.

The issue affects NLnet Labs Unbound versions 1.18.0 through 1.25.1 that are configured to listen on a proxy‑protocol‑port with answer‑cookie set to yes. All other version numbers or configurations are unaffected.

The exploit requires the attacker to perform a legitimate DNS query to harvest a cookie, after which the cookie may be replayed from any spoofed source behind the same proxy node. The attack is off‑path and does not require direct connectivity to the actual client. Because the vulnerability affects only systems with proxy‑protocol enabled and cookie checks, the scope is limited to environments that use proxy‑protocol with DNS cookie validation. The CVSS score of 3.7 indicates moderate severity, but the exploitability is enabled by widely deployed proxy‑protocol setups. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not yet targeted as a known exploit. Nevertheless, patching is recommended to remove the possibility of cookie forgery.