The caddy-defender plugin for Caddy before version 0.10.1 improperly used the immediate peer IP address (r.RemoteAddr) for access control decisions instead of the resolved original client IP (client_ip) when behind trusted proxies. This flaw allowed clients from blocked IP ranges to bypass IP-based blocking if traffic passed through a trusted proxy or CDN whose IP was not blocked. The vulnerability is addressed in version 0.10.1 by preferring the resolved client_ip variable for blocking decisions, falling back to RemoteAddr only if client_ip is unavailable. Deployments without intermediate proxies are unaffected. No full workaround exists in affected versions; users should implement equivalent IP blocking at the proxy or edge before traffic reaches Caddy.

Clients from IP ranges that should be blocked can bypass caddy-defender's blocking when accessing Caddy behind trusted proxies, CDNs, or load balancers. This results in improper access control, potentially allowing unauthorized access or evasion of IP-based restrictions. The vulnerability does not affect deployments where Caddy receives traffic directly from clients without intermediate proxies.

A fix is available in caddy-defender version 0.10.1, which correctly uses Caddy's resolved client_ip for access control. Users should upgrade to version 0.10.1 or later to remediate this issue. Until upgrading, affected deployments must enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy, as no complete workaround exists within affected Defender versions. Deployments without intermediate proxies are not affected and require no action.