CVE-2022-2368: Microweber before 1.2.21 allows attacker to bypass IP detection to brute-force password

The vulnerability stems from improper IP validation in the login mechanism. The patch adds a new server-side IP check using $_SERVER['REMOTE_ADDR'], indicating the original implementation only used client-controlled headers for IP tracking. The login function (::login) was modified to add this critical security check, confirming it was the vulnerable entry point where IP spoofing could bypass rate limiting. The commit message and CWE-290 classification directly point to authentication bypass via header spoofing in the login process.