[MEDIUM] CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

PKSA-kcc6-gffv-vchj CVE-2026-63220 GHSA-7wmf-pw8j-mc78

Affected package: codeigniter4/framework

Affected version: <4.7.4

Reported by:
GitHub