CVE-2026-100390

19th percentile - higher than 19% of all known CVEs

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

An attacker can bypass IP-based authorization controls, gaining unauthorized access to protected resources.

Update Zoraxy to a version later than 3.3.4 if available, or fix IPv6 address parsing in the RemoteAddr field to prevent spoofing of X-Forwarded-For headers.