Remark42, a self‑hosted comment engine, globally accepts the True-Client-IP, X-Real-IP, and X-Forwarded-For headers without confirming that the sender is a trusted proxy. Because the middleware overwrites r.RemoteAddr before per‑IP controls are applied, a remote attacker can rotate spoofed forwarding headers to constantly regenerate fresh token buckets for rate‑limited endpoints. This negates rate limits, bypasses vote de‑duplication when the --votes-ip option is enabled, allows minting of anonymous identities, and can corrupt stored comment IP addresses and server logs. The abuse primarily impacts service availability by enabling an attacker to overwhelm the system, and may also allow data‑tampering in logs.

The affected product is Remark42 from vendor umputun. Versions 1.0.0 through 1.16.2, inclusive, are vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network attack that targets systems where the application is directly reachable or behind a proxy that forwards attacker‑controlled headers. Because the vulnerability bypasses rate limiting and other per‑IP controls, exploitation can lead to denial of service and potential abuse of comment functionality. The mitigations rely on configuring trusted proxies, which limits the validity of forwarding headers to known, secure interfaces.