A critical vulnerability in Cloudflare’s ACME HTTP-01 validation logic allowed attackers to bypass Web Application Firewall protections and directly access origin servers, exposing millions of websites — including cryptocurrency exchanges and DeFi platforms — to potential exploitation. The flaw was discovered by security researchers from FearsOff on October 13, 2025, and patched by Cloudflare on October 27, 2025.
The Exploit Mechanics
The vulnerability stemmed from how Cloudflare’s edge servers handled requests to the /.well-known/acme-challenge/ path. The ACME (Automatic Certificate Management Environment) protocol is used by certificate authorities to verify domain ownership before issuing SSL certificates. During HTTP-01 validation, the CA checks a one-time token at a specific URL, and the process should grant access only to that exact path.
However, Cloudflare’s implementation had a critical flaw: it disabled WAF protections for the entire ACME challenge path, regardless of whether a valid token existed. This meant that any request to /.well-known/acme-challenge/{anything} would bypass all account-level WAF rules and reach the origin server directly. Researchers from FearsOff demonstrated that while normal paths returned Cloudflare block pages, crafted ACME paths returned origin-generated 404 responses, confirming that the WAF had been completely circumvented.
The attack vector was deceptively simple. An attacker could target any domain behind Cloudflare’s WAF by sending requests to a crafted ACME challenge path. Because the WAF was disabled on this path, all header-based attack vectors became viable: Server-Side Request Forgery (SSRF) through X-Forwarded-Host headers, SQL injection via header-driven concatenation in legacy code, cache key poisoning, and method override tricks using X-HTTP-Method-Override headers.
Affected Systems
The impact extended to any website using Cloudflare’s WAF, which includes a significant portion of cryptocurrency exchanges, DeFi platforms, and blockchain-based services. The FearsOff report specifically highlighted several attack scenarios that became possible during the vulnerability window:
Spring and Tomcat endpoints could expose sensitive environment variables through framework-specific error handling. Next.js Server-Side Rendering pages could leak operational details. PHP routing configurations could expose files through Local File Inclusion (LFI) bugs. For crypto platforms specifically, the risk was amplified because many exchanges and DeFi applications rely on Cloudflare’s WAF as their primary defense against automated attacks, API abuse, and exploit attempts.
With Bitcoin trading at approximately $114,000 and Ethereum above $4,100 on the date the fix was deployed, the potential financial impact of a successful exploit targeting cryptocurrency infrastructure would have been enormous. A single WAF bypass could have enabled attackers to probe for vulnerabilities in exchange APIs, wallet services, or smart contract interfaces without detection.
The Mitigation Strategy
Cloudflare deployed a code change on October 27, 2025, that fundamentally altered how ACME challenge requests are processed. The fix ensures that WAF features are disabled only when the request matches a valid, active ACME HTTP-01 challenge token for that specific hostname — not for arbitrary paths under the ACME challenge prefix.
After the fix, Cloudflare confirmed that retesting the same attack patterns produced the expected behavior: WAF rules were applied consistently to all requests that did not match a legitimate, pending ACME challenge. The company stated that it found no evidence of malicious exploitation during the two-week vulnerability window between October 13 and October 27.
However, the FearsOff researchers noted that the absence of evidence is not evidence of absence. Sophisticated attackers could have exploited this vulnerability without leaving obvious traces, especially if they used the WAF bypass as a reconnaissance tool rather than launching direct attacks.
Lessons Learned
This incident exposes a fundamental tension in cloud security architectures: the convenience of automated certificate management can inadvertently create security blind spots. When WAF rules are selectively disabled to accommodate legitimate protocols like ACME, the trust boundary shifts from the WAF to the origin server — a server that may not be hardened to face raw internet traffic.
For cryptocurrency platforms, the lesson is particularly relevant. Exchanges and DeFi protocols should not rely solely on cloud-based WAF solutions for their security posture. Defense in depth requires that origin servers are hardened against direct access, with proper access controls, rate limiting, and intrusion detection systems operating independently of any edge proxy or CDN.
The rise of AI-driven attacks makes vulnerabilities like this even more dangerous. Automated tools powered by machine learning can rapidly enumerate and exploit exposed paths like the ACME challenge endpoint, probing for framework-specific weaknesses or misconfigurations at scale. What once required manual reconnaissance can now be accomplished in minutes by AI-powered attack tools.
User Action Required
Cryptocurrency platforms and exchanges should conduct a thorough review of their security architecture in light of this disclosure. Specifically, verify that origin servers are hardened against direct access even when a WAF is in place, implement additional layers of access control such as mutual TLS authentication between the CDN and origin, review logs from the October 13–27 vulnerability window for any suspicious ACME path requests, and ensure that monitoring systems can detect WAF bypass attempts independently of the WAF itself.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
The gap between crypto and TradFi is narrowing fast
two weeks from discovery to patch. every exchange behind cloudflare was exposed and most of them probably didnt even know until the public disclosure. the silent fix era is over
Education is still the biggest barrier to mainstream adoption
Brigitte Larsen education is one thing but cloudflare disabling WAF for an entire path prefix is a basic security fail. the ACME spec is clear about scoped access
Every cycle the infrastructure gets more robust
Bear markets are for building — and builders are delivering
The pace of innovation in crypto continues to surprise me
SSRF via X-Forwarded-Host on a WAF-bypassed path is devastating. any crypto exchange behind cloudflare was vulnerable for weeks
null_pointer_ the X-Forwarded-Host bypass on a WAF-exempt path is genius level exploitation. FearsOff earned every penny of that bounty
FearsOff finding this is impressive. most bug bounty hunters would stop at the 404 difference and not escalate to SSRF. quality research