CVE-2026-111934 in Coder
Summary
by MITRE • 10/17/2026
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Coder prior to version 2.34.7 represents a critical failure in input validation within the ExtractRealIPAddress middleware component. This flaw stems from an incorrect trust model regarding network headers commonly used in proxied environments, specifically the X-Forwarded-For header. In standard web architecture, when requests pass through reverse proxies or load balancers, these intermediaries append their own IP addresses to the end of the X-Forwarded-For chain to maintain a complete history of the request path. The application's middleware erroneously assumes that the leftmost value in this comma-separated list is always the original client IP address. However, because HTTP headers are user-controllable data sent by the initial requester, an attacker can manipulate this header to inject arbitrary values at the beginning of the chain. By doing so, the middleware accepts these forged addresses as legitimate source IPs, completely bypassing any security controls that rely on accurate client identification.
This misconfiguration directly facilitates IP spoofing attacks with significant operational consequences for application security and integrity. The most immediate impact is the ability to circumvent per-IP rate limiting mechanisms applied to sensitive authentication endpoints such as login pages, one-time passcode generation, and password validation services. Since the application believes it is communicating with a different source than the actual attacker, it fails to enforce limits on request frequency from that specific IP address. This allows adversaries to conduct brute-force attacks against user accounts without triggering protective throttling measures designed to detect and block excessive failed authentication attempts. The lack of effective rate limiting significantly lowers the barrier for automated credential stuffing or password guessing campaigns, increasing the likelihood of unauthorized access if weak credentials are in use.
Beyond the immediate risk of account compromise, this vulnerability undermines the reliability of security auditing and forensic analysis capabilities within the Coder platform. Audit logs that record source IP addresses will capture the spoofed values injected by attackers rather than their true network origin. This obfuscation makes it difficult for security operations teams to trace malicious activity back to its source, hindering incident response efforts and potentially allowing persistent threats to operate undetected over extended periods. The falsification of log data also complicates compliance reporting where accurate tracking of access sources is required by regulatory frameworks or internal governance policies.
From a classification perspective, this issue aligns with CWE-287 Improper Authentication, as the system fails to correctly identify and authenticate the client's identity due to flawed input validation. It also relates closely to CWE-918 Enabling Server-Side Request Forgery (SSRF) Misconceptions in header handling, although its primary impact here is authentication bypass rather than server-side request manipulation. In terms of adversary tactics, this vulnerability supports techniques associated with MITRE ATT&CK T1078 Valid Accounts and potentially T1190 Exploit Public-Facing Application, as it enables attackers to leverage public-facing endpoints for unauthorized access while evading detection mechanisms.
To mitigate this risk, organizations running Coder versions earlier than 2.34.7 must upgrade immediately to the patched version where the middleware logic has been corrected to properly parse the X-Forwarded-For header chain. The fix involves ensuring that the application trusts only the IP address appended by trusted reverse proxies at the end of the chain, rather than blindly accepting the first value provided in the header. Additionally, administrators should implement defense-in-depth strategies such as deploying Web Application Firewalls configured to strip or validate X-Forwarded-For headers from untrusted sources before they reach the application backend. Regularly updating dependencies and reviewing middleware configurations for trust boundaries is essential to prevent similar misconfigurations that compromise identity verification mechanisms in proxied environments.