TI-2026-70553 CVE-2026-108555 · GHSA-4p3m-fhg8-5wfcIP spoofing in PairDrop via forged cf-connecting-ip headerPriority LOW 11PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header.CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00135 · Published 2026-10-10 · No fix listed CWE-348