CVE-2026-100390 in Zoraxy
Riassunto
di MITRE • 25/09/2026
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.