Lemmy’s rate‑limiting logic incorrectly trusts the X‑Forwarded‑For header, allowing any attacker to prepend a spoofed IP address. This user‑controlled input incorrectly populates the bucket key, creating a new rate‑limit bucket for each distinct spoofed address. The result is a bypass of rate limits on several crucial endpoints, such as account registration, login, posting, commenting, image uploads, searches, and settings imports, enabling excessive account creation, credential stuffing, spam, and continuous scraping. The vulnerability is categorized under CWE‑799 for improper handling of user‑controlled data that can pollute server‑side state.

The flaw exists in LemmyNet:lemmy releases before version 0.19.19 and 1.0.0‑beta.1. The bundled Docker and Nginx configuration uses the $proxy_add_x_forwarded_for variable, which appends the real client address, allowing the attacker’s spoofed value to be placed first in the list processed by Lemmy’s rate‑limiting module.

The CVSS score of 6.5 indicates moderate severity, and the vulnerability is exploitable via standard HTTP requests that can be crafted by an unauthenticated attacker in the public network. EPSS data is not available, and the issue is not currently listed in the CISA KEV catalog. However, because the flaw permits uncontrolled resource consumption and facilitates credential‑stuffing and spam operations, the overall risk can be significant, especially for publicly exposed instances that do not enforce trusted proxy settings or complementary rate‑limit controls.