CVE-2026-108899 in zoraxy
Summary
by MITRE • 10/12/2026
A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in TobyChui Zoraxy versions up to 3.3.4 represents a critical authentication bypass flaw within its dynamic proxy module, specifically affecting the Path Exception Matcher functionality. This security defect resides in the handleBasicAuth function located in the mod/dynamicproxy/authProviders.go file. The core technical issue stems from improper validation and handling of the PathPrefix argument during authorization checks. When an attacker provides a manipulated or malformed PathPrefix value, the application fails to correctly enforce access control policies associated with that specific path segment. This logical error allows unauthorized entities to bypass basic authentication mechanisms intended to protect sensitive administrative interfaces or restricted proxy endpoints. The flaw is not merely a configuration oversight but a fundamental logic failure in how the software evaluates path-based exceptions against user credentials, leading to improper authorization decisions where valid users might be denied access while invalid actors gain entry.
From an operational perspective, this vulnerability poses a severe risk as it can be exploited remotely over standard network connections without requiring prior authentication or complex preconditions. The availability of public exploit code significantly lowers the barrier for attack execution, enabling threat actors to rapidly compromise systems running affected versions. Successful exploitation could lead to unauthorized access to administrative controls, potential data exfiltration, or further lateral movement within a protected network environment if Zoraxy is deployed as a gateway between internal services and external traffic. The impact extends beyond simple privilege escalation; it undermines the integrity of the entire proxy infrastructure by allowing attackers to manipulate routing decisions and intercept sensitive communications that should be secured by basic authentication protocols.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-434, an Unrestricted Upload of File with Dangerous Type if file handling is involved in the path logic, though primarily it reflects a failure to enforce access control correctly based on input parameters. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1078, Valid Accounts, by allowing attackers to use stolen or default credentials more effectively due to the bypass mechanism, and potentially T1505.003, Server Software Component, if the proxy component itself is leveraged for persistent access. The ability to manipulate path prefixes suggests a potential vector for path traversal attacks as well, depending on how the backend services interpret these paths after authentication has been incorrectly skipped or altered.
To mitigate this risk, immediate action is required to upgrade Zoraxy to version 3.3.5-rc1 or any subsequent stable release that incorporates the fix identified by patch hash 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. This update addresses the logic error in the handleBasicAuth function, ensuring that PathPrefix arguments are validated and processed correctly to enforce authorization rules as intended. Organizations should verify their deployment versions immediately and apply the patch across all instances of Zoraxy acting as reverse proxies or API gateways. Additionally, implementing network-level access controls such as IP whitelisting for administrative interfaces can provide a layer of defense-in-depth while patches are being deployed. Regular monitoring of authentication logs for anomalous patterns related to path exceptions is also recommended to detect any potential exploitation attempts that may have occurred prior to remediation.