Product
An unauthenticated attacker can spoof their remote IP address in Rails 8.1.0-8.1.4 by providing a malicious Forwarded header, potentially bypassing IP-based access controls and rate limiting.