CVE-2026-108555 — PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connec…
Published: 2026-10-10 · CVSS: 2.3 · CVSS 4.0
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7