Coder EUVD-2026-103301

Exploitation requires Coder (before 2.34.7) to be deployed behind a reverse proxy that APPENDS the client IP to X-Forwarded-For rather than overwriting it - the ExtractRealIPAddress middleware trusts the leftmost (client-controlled) value, so the attacker-supplied address is honored. This matches the CVSS AT:P attack requirement. No authentication is required (PR:N) and no user interaction is needed (UI:N); the attacker only needs network reachability to the login, one-time-passcode, or password-validation endpoints and the ability to set the X-Forwarded-For header. Limiting factors: if Coder is exposed directly or fronted by a proxy that strips/overwrites X-Forwarded-For, the leftmost value is not attacker-trusted and exploitation fails; impact is further bounded to rate-limit bypass and audit-log IP falsification, not direct code execution or data disclosure.

This is a genuine but moderate-severity issue, not a critical priority. The CVSS 4.0 base score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N) reflects network-reachable, unauthenticated access with low attack complexity, but with an Attack Requirement (AT:P) - the flaw only manifests when Coder sits behind an appending reverse proxy - and impact limited to integrity (VI:L), with no confidentiality or availability effect. No EPSS score, CISA KEV listing, or POC is present in the supplied data; per the precision rules this means no public exploit is identified at time of analysis, so there is no evidence of active or automatable exploitation. The practical impact is indirect: bypassing per-IP rate limits on login, one-time-passcode, and password-validation endpoints weakens brute-force defenses, and forged X-Forwarded-For values corrupt audit-log attribution. These signals are internally consistent (low integrity impact, attack-requirement gated, no direct code execution or data disclosure), so this is a real but defense-in-depth-level issue rather than a drop-everything emergency. Key missing data: EPSS probability and POC status are absent and cannot be inferred - treat exploitation likelihood as unquantified.

An attacker targeting a Coder deployment behind an appending reverse proxy sends repeated login or one-time-passcode requests, each carrying a different forged leftmost X-Forwarded-For value, so the ExtractRealIPAddress middleware attributes each attempt to a distinct fake client IP and never trips the per-IP rate limit. This lets the attacker run an unthrottled credential brute-force while simultaneously poisoning audit logs with spoofed source addresses. No public exploit code is identified, but the technique requires only crafted HTTP headers (AV:N/AC:L).