CVE-2026-100390
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
- State
- Published
- Severity
- 9.1 Critical
- Published
- Sep 25, 2026
- Updated
- Sep 25, 2026
- Reserved
- Sep 25, 2026
Description
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.1 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
zoraxytobychui |
|
References
- Pull Request #1264issue-trackingpatch
- Patch Commitpatch
- https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142technical-description
- https://github.com/tobychui/zoraxyproduct
- VulnCheck Advisory: Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.