Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck
CVE-2026-100390Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
High 7.4
In plain English
A high-severity authentication bypass by spoofing in zoraxy from tobychui. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.3%top 78.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Affected products (as reported)
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- Pull Request #1264 issue-tracking, patch
- Patch Commit patch
- https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142 technical-description
- https://github.com/tobychui/zoraxy product
- VulnCheck Advisory: Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6 third-party-advisory