CVE-2026-100390: Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Zoraxy versions 3.2.3 through 3.3.4 are affected where authorization providers use client IP-based access controls. Exploitation requires the attacker to connect to Zoraxy over IPv6.
Does exploitation require authentication or user interaction?
No. The issue can be exploited by an unauthenticated attacker, and no user interaction is required.
What access-control impact can spoofing the source IP have?
An attacker can provide an arbitrary X-Forwarded-For value and impersonate a permitted source IP. This can bypass authorization-provider controls that make access decisions based on client IP addresses.