The vulnerability resides in the ExtractRealIPAddress middleware of the Coder platform. The code tolerates the first value of a client‑supplied X‑Forwarded‑For header as the real client IP, thereby ignoring the IP appended by the reverse proxy. Attackers can craft or append X‑Forwarded‑For values from intermediate proxies to present an arbitrary IP address to the Coder application. This permits brute‑force login attempts to evade per‑IP rate limits, and it allows malicious actors to create misleading audit trail entries.

This issue affects all releases of Coder before version 2.34.7. The vendor listed is coder:coder, and the product has been patched as of the 2.34.7 release. No further sub‑versions or modules are indicated in the advisory.

The CVSS score is 6.3, placing the vulnerability in the medium severity range. The EPSS score is not available and the vulnerability is not present in the CISA KEV catalog, so the current exploitation probability is low to moderate. Exploitation requires an attacker’s ability to insert a forged X‑Forwarded‑For header, typically by controlling a proxy that forwards traffic to the Coder instance. Since the approach relies on standard proxy behavior, the attack vector is potentially accessible to any entity able to position itself as an intermediate proxy.