This vulnerability in Saleor up to version 3.23.14 affects the get_client_ip function responsible for throttling authentication attempts. The issue arises because the function relies on the X-Forwarded-For header to identify client IPs, which can be spoofed in many deployments, allowing attackers to bypass throttling restrictions. The vendor acknowledges the issue but considers it expected behavior contingent on correct XFF configuration. A proposed fix involving right-to-left RFC 7239 hop selection remains unmerged. The vulnerability has been publicly disclosed, but exploitation is considered difficult and requires high complexity.

If exploited, an attacker could bypass the throttling mechanism designed to limit excessive authentication attempts by spoofing IP addresses. This could potentially allow brute force or credential stuffing attacks to proceed without restriction. However, the vendor states this is expected behavior assuming proper XFF configuration, and the exploitability is difficult, limiting the practical impact.

The vendor indicates no vulnerability exists if the X-Forwarded-For header is configured properly. Therefore, the primary mitigation is to ensure correct and secure configuration of the XFF header in the deployment environment. No official patch or fix has been released yet. Monitor vendor advisories for updates on the proposed fix involving RFC 7239 hop selection.