Mukd-482 |work|

Because the check only validates the source IP against a hard‑coded CIDR that can be spoofed via the X-Forwarded-For header, an attacker on the internet can satisfy the condition and be logged in as admin .

to POST /login with the following JSON body: mukd-482

The attacker receives a valid session cookie ( SESSIONID ) with full admin privileges. Because the check only validates the source IP