IP Spoofing Vulnerability in Coder by Coder
CVE-2026-111934

6.3MEDIUM

Key Information:

Vendor

Coder

Status
Coder
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111934?

Coder versions earlier than 2.34.7 are susceptible to an IP spoofing vulnerability through the ExtractRealIPAddress middleware. This vulnerability arises because the software incorrectly prioritizes the leftmost, client-supplied X-Forwarded-For value, thereby allowing attackers to manipulate the IP address reported by the application. By exploiting this flaw, attackers can bypass important per-IP rate limits on crucial login processes, one-time passcodes, and password validation endpoints. As a result, this could enable brute-force attacks and lead to falsified IP addresses in audit logs, compromising overall system integrity and security.

Affected Version(s)

coder 0 < 2.34.7

coder 2.34.7

References

https://github.com/coder/coder/security/advisories/GHSA-v...
vendor-advisory
https://www.vulncheck.com/advisories/coder-before-2.34.7-...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.