TI-2026-71023 Aliases CVE-2026-108899 GHSA-6qcv-qc7g-33wv

Improper authorization in tobychui Zoraxy Path Exception Matcher

HIGH 70CWE-266Published 2026-10-12 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.

Summary

Zoraxy from 3.3.0 before 3.3.5-rc1 contains an improper authorization flaw in the handleBasicAuth function of the Path Exception Matcher component. Manipulating the PathPrefix argument causes improper authorization (CWE-285). A remote attacker without privileges or user interaction can exploit it, with a low impact on confidentiality, integrity and availability. A public exploit has been published and is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00454 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed zoraxy (tobychui): 3.3.5-rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
tobychui	zoraxy	3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4	3.3.5-rc1	Patch available	CNA

zoraxy Vendortobychui Affected 3.3.0; 3.3.1; 3.3.2; 3.3.3; 3.3.4 Fixed in 3.3.5-rc1 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tobychui:zoraxy::::::::	—	—	tobychui

cpe:2.3:a:tobychui:zoraxy:*:*:*:*:*:*:*:* Versions — — ·tobychui

Remediation

Upgrade Zoraxy to version 3.3.5-rc1, which fixes this issue with patch commit 37cd0f27b17cd15cfa4af409bfec943146f5fdfe.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA zoraxy (tobychui) Fixed in 3.3.5-rc1

Timeline

2026-10-12 Threatist record created from CVE-2026-108899
2026-10-12 Alias added: GHSA-6qcv-qc7g-33wv
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: MEDIUM → HIGH

References

Exploit 1

https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundary

Patch 3

Other 1

https://github.com/tobychui/zoraxy/

TI-2026-64663 Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6 CVSS 4.0CRITICAL 9.1
TI-2024-34897 Zoraxy has an authenticated command injection in the Web SSH feature CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences