ezBookkeeping IP allowlist bypass via X-Forwarded-For header

A critical authentication bypass vulnerability in ezBookkeeping allows remote attackers to defeat the source-IP allowlist for MCP and API token endpoints by sending a spoofed X-Forwarded-For header, since the application trusts all proxies by default.

Disclosed 9 November 2026 · Record updated 10 November 2026

Impact

Attackers can bypass IP-based access controls on MCP and API token endpoints from any source IP, while forging audit logs to appear as though requests came from allowlisted IPs.

Our coverage

A fortress wall crumbles as a single forged badge slips past the guards, granting entry to the inner vault where ledgers lie unprotected.

Vulnerabilities

ezBookkeeping IP allowlist falls to a single spoofed header

A advisory published on 9 November 2026 says attackers can defeat the MCP and API token IP allowlist in ezBookkeeping by adding one request header.

10 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-wchh-mrv2-5h4q