by Kastro
Paper/Archive/CVE-2026-100390

CVE-2026-100390

tobychui zoraxy — Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 21.6.216 × 204.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

Affected

ProductAffectedFixed inSource
zoraxy3.2.3 – 3.3.4–CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchgithub.com/tobychui/zoraxy/pull/1264patchgithub.com/tobychui/zoraxy/commit/56bb3e5abb83eae42a64203028d73a001d6096c4writeupgithub.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142refgithub.com/tobychui/zoraxywriteupvulncheck.com/advisories/zoraxy-3.2.3-through-3.3.4-client-ip-spoofing-via-x-forwarded-for-ipv6