Vendor
Zoraxy versions up to 3.3.4 are vulnerable to a remote authorization bypass in the Path Exception Matcher component that allows attackers to manipulate PathPrefix arguments.