Authentication Bypass via X-Forwarded-For Spoofing in SuggestArr local_bypass Mode

Summary

enforce_authentication() decides local_bypass trust from request.remote_addr, which ProxyFix(x_for=1) fills in from the X-Forwarded-For header. A spoofed loopback or private address therefore passes _is_trusted_local_ip(), and _load_bypass_user_context() returns an admin user.

Details

• api_service/auth/middleware.py, enforce_authentication():
• client_ip = request.remote_addr
• if auth_mode == "local_bypass" and _is_trusted_local_ip(client_ip): _apply_auth_context(_load_bypass_user_context(), ...)
• api_service/app.py:94: ProxyFix(application.wsgi_app, x_for=1, ...)

Proof of concept

1. Run ciuse99/suggestarr:latest with AUTH_MODE=local_bypass and AUTH_TRUSTED_CIDRS=127.0.0.1/32.
2. Create the first admin user so the instance leaves setup mode.
3. From a host outside the trusted range, request these endpoints without the header. Both return 401:

GET /api/users
GET /api/jobs

1. Send the same requests with the spoofed header. Both return 200 with full admin data (the admin user list and job configs):

GET /api/users
X-Forwarded-For: 127.0.0.1

The two sets of requests differ only in the attacker-controlled header.

Impact

When local_bypass mode is enabled, an unauthenticated remote attacker who can reach SuggestArr gets full admin access. The only requirement is an X-Forwarded-For header with an address inside the trusted CIDRs. The default CIDRs are 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1,fc00::/7. The attacker can read admin data such as the user list and job configurations.