CVE-2026-111934

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.7

Description An IP spoofing issue exists in the ExtractRealIPAddress middleware. The system incorrectly trusts the leftmost value provided by the client in the X-Forwarded-For header rather than the client IP appended by a reverse proxy. This allows attackers to send forged X-Forwarded-For values to bypass per-IP rate limits on the login, one-time passcode, and password validation endpoints, facilitating brute-force attacks and the falsification of IP addresses in audit logs.

Recommendations Update to version 2.34.7 or later.