CVE-2026-100390

Received Received - Intake

Zoraxy IPv6 X-Forwarded-For Spoofing Vulnerability

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100390

Affected Vendors & Products

Vendor	Product	Version / Range
zoraxy	zoraxy	From 3.2.3 (inc) to 3.3.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

Zoraxy versions 3.2.3 through 3.3.4 improperly handle IPv6 addresses in the RemoteAddr field when setting forwarded headers. This allows unauthenticated attackers using IPv6 to inject fake X-Forwarded-For headers, spoofing their source IP address and bypassing IP-based access controls enforced by authorization providers.

Detection Guidance

Check Zoraxy logs for IPv6 connections with unusual X-Forwarded-For headers. Inspect forwarded headers in HTTP requests for IPv6 addresses that do not match the RemoteAddr field.

Impact Analysis

An attacker could exploit this to bypass IP-based restrictions, potentially gaining unauthorized access to protected resources or services. This could lead to data breaches, unauthorized actions, or further network compromise depending on the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating compliance requirements for GDPR (data protection) and HIPAA (health information security). Organizations may face penalties or legal consequences if such breaches occur due to inadequate access controls.

Mitigation Strategies

Upgrade Zoraxy to a version beyond 3.3.4 where IPv6 parsing is fixed. Temporarily block IPv6 traffic if upgrading is not possible. Review and tighten IP-based access controls.

Hi! I’m here to help you understand CVE-2026-100390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70