LemmyNet's lemmy prior to versions 0.19.19 and 1.0.0-beta.1 uses actix-web's ConnectionInfo::realip_remote_addr which reads the first value of the X-Forwarded-For header as the client IP for rate limiting. The bundled docker/nginx.conf configuration appends the real client IP to any existing X-Forwarded-For header rather than replacing it, allowing an attacker to spoof the first IP address in the header on each request. This causes the rate limiting logic to treat each request as coming from a different client IP, effectively bypassing rate limits on several critical API endpoints. This can lead to excessive account creation, brute-force login attempts, spam, scraping, uploads, and repeated imports. The vulnerability is addressed in lemmy versions 0.19.19 and 1.0.0-beta.1.

An unauthenticated attacker can bypass rate limiting controls on key API endpoints by spoofing the client IP address in the X-Forwarded-For header. This enables excessive account creation, brute-force login attempts, spam posting, data scraping, image uploads, and repeated import operations. The vulnerability impacts the integrity and availability of the lemmy service by allowing abuse of functionality intended to be rate-limited.

This vulnerability is fixed in lemmy versions 0.19.19 and 1.0.0-beta.1. Users should upgrade to at least these versions to remediate the issue. No additional mitigation is required if running these fixed versions.