---
id: "CVE-2026-111934"
kind: "vulnerability"
aliases: ["CVE-2026-111934"]
title: "Coder: forged X-Forwarded-For bypasses login rate limits and audit IPs"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["audit-logging", "coder", "other", "reverse-proxy", "self-hosted"]
not_affected_if: ["no-reverse-proxy", "version-2.34.7-or-later"]
published_at: "2026-10-17T19:16:36+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:01:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111934", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: forged X-Forwarded-For bypasses login rate limits and audit IPs

Coder before 2.34.7 trusts the leftmost, client-supplied X-Forwarded-For value when deriving the client IP, instead of the address appended by the reverse proxy. An attacker can forge that header to evade per-IP rate limits on login, one-time passcode and password checks, enabling brute force, and to write false IP addresses into audit logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder version with `coder version`; versions below `2.34.7` are affected.
- Check whether Coder sits behind a reverse proxy that appends to X-Forwarded-For, which is the setup where the flaw applies.

## Fix

- Upgrade Coder to `2.34.7` or later.
- Until upgraded, rely on rate limiting at the reverse proxy keyed on the proxy-appended client address, not on the header value sent by the client.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111934

## From the sources

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_