{"id":"GO-2025-4207","revision":"2fdb0b1e4b64495f8b81936e12f6f92b","records":[{"revision":"2fdb0b1e4b64495f8b81936e12f6f92b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4207","aliases":["CVE-2025-66508","GHSA-7cqv-qcq2-r765"],"title":"1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers in github.com/1Panel-dev/1Panel","description":"1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers in github.com/1Panel-dev/1Panel","state":0,"publishedAt":"2025-12-15T19:37:35+00:00","modifiedAt":"2026-03-03T04:57:46.442949+00:00","affected":[{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.14+incompatible"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel/agent","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20251201063338-94f7d78cc976"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765","https://nvd.nist.gov/vuln/detail/CVE-2025-66508","https://github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4207","license":"OSV · upstream source license applies","key":"osv:GO-2025-4207","identifiers":["GO-2025-4207","CVE-2025-66508","GHSA-7cqv-qcq2-r765"]},"retained":false,"historicalAffected":[]}],"coverage":[]}