CVE-2026-108899

tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

State: Published
Severity: 6.9 Medium
Published: Oct 12, 2026
Updated: Oct 13, 2026
Reserved: Oct 11, 2026

Description

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
zoraxytobychui	3.3.0Affected 3.3.1Affected 3.3.2Affected 3.3.3Affected 3.3.4Affected 3.3.5-rc1Not affected

References

VDB-416690 | tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorizationvdb-entrytechnical-description
VDB-416690 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-108899 | CVE Analysis and Reportthird-party-advisory
Submit #976047 | https://github.com/tobychui/ zoraxy <= 3.3.4 Improper Input Validationthird-party-advisory
https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundaryexploit
https://github.com/tobychui/zoraxy/pull/1291issue-trackingpatch
https://github.com/tobychui/zoraxy/commit/37cd0f27b17cd15cfa4af409bfec943146f5fdfepatch
https://github.com/tobychui/zoraxy/releases/tag/v3.3.5-rc1patch
https://github.com/tobychui/zoraxy/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.