Echo v5 contains a vulnerability in the ExtractIPFromRealIPHeader function where it trusts the X-Real-IP header value without verifying the direct network peer's address. This allows an untrusted client to spoof IP addresses such as loopback or private addresses. Applications relying on this extractor for IP allowlists, rate limiting, audit logs, or forwarding headers may accept spoofed client identities. Versions from 5.0.0 through 5.4.0 are affected. The issue is fixed in version 5.4.1 by validating the direct peer before accepting the X-Real-IP header.