Zoraxy EUVD-2026-97488

Exploitation requires the Zoraxy host to have a Path Exception rule configured for Basic Auth, ZorxAuth SSO, or CAPTCHA on a protected proxy endpoint - the handleBasicAuth path-exception matcher in mod/dynamicproxy/authProviders.go compares the request path against the exception PathPrefix as a raw string prefix rather than enforcing a path-segment boundary, so a protected URL that textually starts with an exempted prefix is wrongly treated as exempt. No attacker credentials or user interaction are needed (PR:N/UI:N), and the attack is remote over the network (AV:N). The limiting factor is configuration: deployments that do not define path exception rules for these auth providers are not exposed, so the flaw is config-dependent despite being unauthenticated.

Signals are moderate and internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC/VI/VA all Low yields a 6.9 (Medium) score, and the E:P exploit-maturity flag matches the input's 'POC publicly available' signal - a detailed technical write-up and exploit exist on GitHub (carfeii/oss). There is NO CISA KEV listing, so this is 'publicly available exploit code exists', NOT confirmed active exploitation; do not treat it as in-the-wild. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The key nuance CVSS does not capture: although PR:N (unauthenticated) and AV:N are accurate, real-world exploitability depends on a specific deployment choice - the target must use Zoraxy's Path Exception rules for Basic Auth / ZorxAuth / CAPTCHA. Against Zoraxy hosts that do configure such exceptions, this is a genuine unauthenticated authorization bypass worth prompt patching; against hosts that do not use path exceptions, the raw-prefix matching flaw is not reachable. Net: a real, patchable priority for affected Zoraxy operators, but scoped by configuration and by the product's niche footprint rather than a broad internet-wide emergency.

An operator fronts an internal application with Zoraxy and protects it with Basic Auth while exempting a public path (e.g. '/assets') via a Path Exception rule. Because the matcher compares a raw string prefix rather than a path-segment boundary, an unauthenticated attacker requests a protected URL that merely shares that prefix (e.g. '/assets-admin' or '/assetsecret') and Zoraxy treats it as exempt, serving the protected content without credentials. A public proof-of-concept and write-up for this exact path-exception bypass already exist.