Dear Maintainer,

Upstream PR #24889 fixes an authentication bypass in reverse-proxy
client address resolution. The affected code is present in version
5.1.0, and Debian trixie's 5.1.0-2 patches do not modify this code.

When reverse proxy support is enabled, qBittorrent selects the first
X-Forwarded-For entry accepted by QHostAddress::isGlobal(). However,
that function also accepts private addresses. If a trusted proxy
preserves the incoming header and appends the actual client address,
the attacker can control the address selected by qBittorrent.

For authentication bypass, the configuration must also allow clients
from specified IP subnets to bypass authentication. An attacker can
then supply an address from such a subnet and access the WebUI without
the password. Spoofing the address can also evade failed-login IP bans.

Reverse proxy support and subnet authentication exemptions are disabled
by default. This report concerns configurations enabling these features,
not a bypass affecting every default installation.

The upstream fix processes the proxy chain from the nearest hop
outwards, skipping trusted proxies and selecting the first remaining
hop as the client. It is included in upstream 5.3.0.

References:
- Upstream report and fix:
https://github.com/qbittorrent/qBittorrent/pull/24889
- Affected client-address resolution in 5.1.0:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/webui/webapplication.cpp#L873
- Debian 5.1.0-2 patch set:
https://sources.debian.org/patches/qbittorrent/5.1.0-2/

Could you assess this issue for security tracking and backporting to the
affected supported Debian releases?

This report is based on the upstream disclosure and source inspection;
I have not reproduced an attack.

Kind regards,
Jonatan Nyberg