CVE-2026-64619: Fastapi Spoofable Client Ipcve-2026-64619-fastapi-spoofable-client-ip
The application determines the client IP address by directly trusting the `X-Real-IP` or `X-Forwarded-For` HTTP headers and unconditionally falling back to `request.client.host`. Because these headers can be freely modified by clients, an attacker can supply spoofed IP addresses to bypass IP-based rate limiting, tracking, or authentication. Ensure requests a
