CVE-2026-100390
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
tobychui zoraxy
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Text from CVE List
Affected versions 1
- zoraxyaffected: 3.2.3 through 3.3.4CVE List
References 5
- github.com/tobychui/zoraxy/pull/1264Fixvia CVE List
- github.com/tobychui/zoraxy/commit/56bb3e5abb83eae42a64203028d73a001d6096c4Fixvia CVE List
- vulncheck.com/advisories/zoraxy-3.2.3-through-3.3.4-client-ip-spoofing-via-x-forwarded-for-ipv6Advisoryvia CVE List
- github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142Referencevia CVE List
- github.com/tobychui/zoraxyReferencevia CVE List