CVE-2026-111934: coder 0 to before 2.34.7

Affected technology

coder · 0 to before 2.34.7
coder

Description’s affected range: before 2.34.7

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and availability impact as none; integrity impact as low.