The flaw lies in the isSecure() method of the CodeIgniter 4 request handling class. By trusting the X-Forwarded-Proto and Front-End-Https headers sent by any requester, the method can be tricked into declaring an otherwise plain HTTP request to be secure. This misidentification can lead to applications that enforce HTTPS-only access, log sensitive data, or perform security‑related decisions to believe that a connection is protected when it is not. The vulnerability does not allow arbitrary code execution or privilege escalation, but it does undermine the integrity of security controls that depend on accurate protocol detection.

All installations of CodeIgniter 4 that are older than version 4.7.4 are affected. The security issue is specific to the Core framework’s request handling and has no product sub‑version nuance beyond the main 4.x line. Any application built with CodeIgniter 4, regardless of specific business logic, can be impacted if its security configuration relies on the isSecure() method, the force_https() helper, or the global secure request flag.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by sending HTTP requests that include forged X-Forwarded-Proto or Front-End-Https headers, provided the backend is reachable directly over HTTP or a reverse proxy forwards client‑supplied forwarding headers without removing or replacing them. If the application trusts such headers, it will incorrectly treat the connection as secure, potentially bypassing HTTPS enforcement or other security‑sensitive logic.