{"repo":"NousResearch/hermes-agent","public_id":"90702","display_label":"X-Forwarded-For IP spoofing in auth flows","summary":"These items address a security issue where client-controlled X-Forwarded-For headers could be used to spoof IP addresses, potentially bypassing per-IP rate limits and attribution in authentication endpoints. The fix involves trusting only the rightmost value in the header rather than client-supplied ones.","subsystem":"dashboard","counts":{"members":4,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":2},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":133367,"merged_at":"2026-10-05T16:23:23+00:00"},"resolution":{"state":"resolved","by":"pr-133367"},"freshness":{"state":"verified","last_verified_at":"2026-10-05T16:23:23+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[{"issue_number":90702,"pr_number":133367,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-10-05T16:23:23+00:00"}],"members":[{"kind":"issue","number":90702,"title":"[Bug]: /auth/native/authorize pending store fillable for 10min via spoofed X-Forwarded-For (per-IP cap bypass)","url":null,"state":"closed"},{"kind":"pr","number":90736,"title":"fix(dashboard-auth): stop trusting client-controlled X-Forwarded-For for rate-limiting/attribution","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#133367","number":133367},{"kind":"pr","value":"#90702","number":90702}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":91232,"title":"fix(auth): use rightmost X-Forwarded-For value to prevent IP spoofing (#90702)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#90736","number":90736}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":133367,"title":"fix(dashboard-auth): ignore spoofed X-Forwarded-For for login limits","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/dashboard_auth/request_utils.py","hermes_cli/dashboard_auth/routes.py","tests/hermes_cli/test_dashboard_auth_native_flow.py","tests/hermes_cli/test_dashboard_auth_password_login.py","website/docs/user-guide/features/web-dashboard.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}