CVE-2026-100390 in Zoraxy
Summary
by MITRE • 09/25/2026
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Zoraxy versions 3.2.3 through 3.3.4 represents a critical failure in input validation regarding Internet Protocol version six addresses within the context of reverse proxy header manipulation. This flaw specifically affects how the application processes the RemoteAddr field when configuring forwarded headers, which are essential for maintaining accurate client identity information as requests traverse multiple network layers. In standard web architecture, proxies and load balancers rely on these headers to determine the true origin of a request, particularly when implementing security policies based on source IP addresses. The defect arises because the software does not correctly parse or validate IPv6 address formats during this specific header assignment process, leading to ambiguous interpretation of client identity data.
From a technical perspective, the core issue lies in the insufficient sanitization and parsing logic applied to IPv6 inputs within the RemoteAddr context. When an unauthenticated attacker connects via an IPv6 network interface, they are able to inject arbitrary values into the X-Forwarded-For header without triggering validation errors that would typically reject malformed or suspicious input. This lack of strict enforcement allows the client to dictate what source IP address is recorded by the proxy layer. Consequently, the application accepts these spoofed headers as legitimate indicators of origin, effectively decoupling the actual network connection from the logical identity assigned to it within the application context.
The operational impact of this vulnerability is severe, primarily centering on authentication bypass and access control evasion. Many security implementations rely heavily on IP-based whitelisting or blacklisting mechanisms to restrict administrative interfaces or sensitive endpoints to trusted networks. By successfully spoofing their source IP address through the X-Forwarded-For header, an attacker can impersonate a permitted entity. This allows unauthorized individuals to gain access to resources that should be restricted by geographic location, corporate network ranges, or specific host allowances. The ability to bypass these controls undermines the integrity of identity verification processes and exposes internal services to exploitation by external actors who would otherwise be blocked at the perimeter.
This vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to adequately sanitize user-supplied input before processing it for security-critical decisions. Furthermore, it maps directly to MITRE ATT&CK technique T1136.002 Internal IP Spoofing under Adversary Emulation and Evasion techniques, where attackers manipulate network identifiers to bypass access controls. The exploitation vector is classified as Network Access with no required privileges, making it a high-risk issue for any deployment utilizing IPv6 connectivity alongside header-based trust models.
To mitigate this risk, immediate updates to Zoraxy versions 3.2.5 or later are recommended, where the parsing logic has been corrected to properly handle IPv6 addresses and enforce stricter validation on forwarded headers. In environments where upgrading is not immediately feasible, administrators should implement additional security controls at the network perimeter using firewalls or Web Application Firewalls that strip or validate X-Forwarded-For headers before they reach the application layer. Additionally, relying solely on IP-based access control for sensitive resources is discouraged; organizations should adopt multi-factor authentication and certificate-based verification to ensure identity integrity regardless of potential header manipulation.