HedgeDoc versions prior to 1.11.0 enforce rate limits on the /login and /register routes but incorrectly rely on the Cloudflare CF-Connecting-IP header to determine a client’s IP address. When the header is present, HedgeDoc uses it instead of the actual source IP, even if the request does not originate from Cloudflare. An attacker can therefore send a distinct CF-Connecting-IP value with each request to appear as a new IP address and circumvent the rate limits, enabling repeated login attempts or mass account creation. The weakness is represented by CWE‑290 (Authorization Bypass using Misused Credentials) and CWE‑770 (Too Many Objects), and its primary impact is the ability to overwhelm authentication flows, allowing brute‑force or credential‑stuffing attacks.

Any instance of the open‑source HedgeDoc collaborative editor running a version older than 1.11.0. The vendor name is hedgedoc:hedgedoc. No later releases are affected, and the problem was fixed in 1.11.0.

The CVSS score is 6.9, indicating moderate severity. The EPSS score of less than 1 percent shows that exploitation is unlikely but still possible. HedgeDoc is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via simple HTTP requests that include a fabricated CF-Connecting-IP header set to a varying value; no special privileges are required and the attack can be automated. Because the bypass is purely a header manipulation, the risk of widespread account or credential abuse increases if the vulnerability remains unpatched.