Zoraxy
Monthly
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
An improper authorization flaw in Zoraxy up to and including 3.3.4 lets remote, unauthenticated attackers bypass the Basic Auth, ZorxAuth SSO, and CAPTCHA protections that a reverse-proxy administrator has attached to a protected endpoint. The bypass only works on deployments that have configured a Path Exception rule for one of those auth providers: the exception matcher compares the incoming request path against the configured PathPrefix as a raw string prefix instead of enforcing a path-segment boundary, so any protected URL that textually begins with an exempted prefix is treated as exempt and served without authentication. Publicly available exploit code exists (no CISA KEV listing), the issue is reported via VulDB, and upgrading to 3.3.5-rc1 resolves it.
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
An improper authorization flaw in Zoraxy up to and including 3.3.4 lets remote, unauthenticated attackers bypass the Basic Auth, ZorxAuth SSO, and CAPTCHA protections that a reverse-proxy administrator has attached to a protected endpoint. The bypass only works on deployments that have configured a Path Exception rule for one of those auth providers: the exception matcher compares the incoming request path against the configured PathPrefix as a raw string prefix instead of enforcing a path-segment boundary, so any protected URL that textually begins with an exempted prefix is treated as exempt and served without authentication. Publicly available exploit code exists (no CISA KEV listing), the issue is reported via VulDB, and upgrading to 3.3.5-rc1 resolves it.