Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied… (CVE-2026-111934)

The vulnerability in Coder before version 2.34.7 lies in the ExtractRealIPAddress middleware, which trusts the leftmost value of the X-Forwarded-For header supplied by clients rather than the IP appended by a trusted reverse proxy. This allows attackers to send forged X-Forwarded-For headers through appending proxies to bypass rate limiting mechanisms based on IP addresses on login, one-time passcode, and password validation endpoints. Additionally, this can lead to falsified IP addresses recorded in audit logs, potentially obscuring attacker activity.

Attackers can bypass per-IP rate limiting controls on authentication endpoints, increasing the risk of brute-force attacks. The vulnerability also allows falsification of IP addresses in audit logs, which can hinder forensic investigations and incident response. The CVSS score of 3.7 indicates a medium severity impact with low confidentiality impact but some integrity impact due to the ability to manipulate IP-based controls.

A fix is available in Coder version 2.34.7 that corrects the IP address extraction logic in the ExtractRealIPAddress middleware. Users should upgrade to version 2.34.7 or later to remediate this vulnerability. No additional mitigation steps are specified or required beyond applying the official patch.