{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zoraxy--3.3.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tobychui:zoraxy:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108899"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Zoraxy (\u003c= 3.3.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["tobychui"],"content_html":"\u003cp\u003eZoraxy versions up to 3.3.4 contain a critical vulnerability in the \u003ccode\u003ehandleBasicAuth\u003c/code\u003e function within \u003ccode\u003emod/dynamicproxy/authProviders.go\u003c/code\u003e. The issue stems from the Path Exception Matcher component failing to properly validate the \u003ccode\u003ePathPrefix\u003c/code\u003e argument during authorization checks. By manipulating this argument, a remote, unauthenticated attacker can bypass existing authentication controls. The flaw is documented as CVE-2026-108899 and is reported to have public exploit code available, increasing the risk of exploitation by threat actors. Organizations utilizing Zoraxy as a reverse proxy or dynamic routing solution should prioritize patching, as successful exploitation results in unauthorized access to internal resources protected by the proxy.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthorized access to backend services that rely on Zoraxy for Basic Authentication enforcement. This bypass can lead to the exposure of sensitive internal data, unauthorized administrative access, or facilitate further exploitation of protected backend applications. Given the nature of Zoraxy as a proxy, this flaw affects any network sector or infrastructure segment where the proxy is deployed as a gatekeeper.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all instances of Zoraxy to version 3.3.5-rc1 or newer to remediate the vulnerability associated with CVE-2026-108899.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, apply the source code patch provided in commit 37cd0f27b17cd15cfa4af409bfec943146f5fdfe.\u003c/li\u003e\n\u003cli\u003eReview logs for unusual requests to endpoints typically protected by Basic Auth that deviate from standard organizational traffic patterns, specifically looking for anomalous \u003ccode\u003ePathPrefix\u003c/code\u003e parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:32:04Z","date_published":"2026-10-12T18:32:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-zoraxy-auth-bypass/","summary":"Zoraxy versions up to 3.3.4 are vulnerable to a remote authorization bypass in the Path Exception Matcher component that allows attackers to manipulate PathPrefix arguments.","title":"Authorization Bypass in Zoraxy via Path Exception Matcher","url":"https://feed.craftedsignal.io/briefs/2026-10-zoraxy-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Zoraxy (\u003c= 3.3.4)","version":"https://jsonfeed.org/version/1.1"}