Zoraxy (<= 3.3.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/zoraxy--3.3.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:32:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Zoraxy via Path Exception Matcherhttps://feed.craftedsignal.io/briefs/2026-10-zoraxy-auth-bypass/Mon, 12 Oct 2026 18:32:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-zoraxy-auth-bypass/Zoraxy versions up to 3.3.4 are vulnerable to a remote authorization bypass in the Path Exception Matcher component that allows attackers to manipulate PathPrefix arguments.Zoraxy versions up to 3.3.4 contain a critical vulnerability in the handleBasicAuth function within mod/dynamicproxy/authProviders.go. The issue stems from the Path Exception Matcher component failing to properly validate the PathPrefix argument during authorization checks. By manipulating this argument, a remote, unauthenticated attacker can bypass existing authentication controls. The flaw is documented as CVE-2026-108899 and is reported to have public exploit code available, increasing the risk of exploitation by threat actors. Organizations utilizing Zoraxy as a reverse proxy or dynamic routing solution should prioritize patching, as successful exploitation results in unauthorized access to internal resources protected by the proxy.

Impact

The vulnerability allows unauthorized access to backend services that rely on Zoraxy for Basic Authentication enforcement. This bypass can lead to the exposure of sensitive internal data, unauthorized administrative access, or facilitate further exploitation of protected backend applications. Given the nature of Zoraxy as a proxy, this flaw affects any network sector or infrastructure segment where the proxy is deployed as a gatekeeper.

Recommendation

  • Immediately upgrade all instances of Zoraxy to version 3.3.5-rc1 or newer to remediate the vulnerability associated with CVE-2026-108899.
  • If an immediate upgrade is not feasible, apply the source code patch provided in commit 37cd0f27b17cd15cfa4af409bfec943146f5fdfe.
  • Review logs for unusual requests to endpoints typically protected by Basic Auth that deviate from standard organizational traffic patterns, specifically looking for anomalous PathPrefix parameters.
]]>highadvisory