CVE-2026-64798HighPublished 22 July 2026

Regular Labs IP Login (iplogin) <= 6.2.5 - Client-IP Spoofing and Weak Login Key Entropy (account impersonation)

Regular Labs IP Login up to and including 6.2.5. IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy, so an attacker could spoof the IP used for automatic login and impersonate the mapped account (CVE-2026-64797). Persistent URL login keys were also generated with a non-cryptographic random generator with insufficient entropy, making them guessable (CVE-2026-64798). Also affected by CVE-2026-63265. Fixed in the Regular Labs security release of 22 July 2026 (7.0.0).

Affected versions: ≤ 6.2.5

Official record: cve.org · NVD

Related vulnerabilities

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

Affected extensions and versions

HighCVE-2026-64797 CVE-2026-64798 CVE-2026-632652026-07-22

Regular Labs IP Login

Affected versions: ≤ 6.2.5

Full advisory: our disclosure post

Our disclosure post

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs.

22 Jul 2026

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

Rules current as of 25 August 2026.