The vulnerability in Saleor's get_client_ip function allows an attacker to manipulate IP address detection, potentially bypassing throttling mechanisms designed to limit excessive authentication attempts. This is due to the ability to spoof the IP in most deployments, as acknowledged in the project's internal issue #19203. The vendor clarifies that this is not considered a vulnerability but expected behavior contingent on correct X-Forwarded-For header configuration. The proposed fix involving right-to-left RFC 7239 hop selection remains unmerged. The CVSS score is 3.7 (low), with network attack vector, high attack complexity, no privileges required, and no user interaction.

The impact is limited to improper restriction of excessive authentication attempts, which could allow an attacker to bypass rate limiting by spoofing IP addresses. There is no direct confidentiality, integrity, or availability impact. Exploitation requires high complexity and no privileges, making it difficult to exploit in practice.

The vendor states this behavior is by design and expects proper configuration of the X-Forwarded-For header to prevent IP spoofing. No official patch or fix has been released. Users should ensure their deployment correctly configures trusted proxy headers to mitigate this issue. Monitor the vendor's repository for any future fixes or updates.