HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-100390 — Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the...

·Source: NIST NVD

Updated:

Executive Summary

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.

Analysis

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls. CVSS Score: 7.4. Published: 2026-09-25T21:17:22.637.

Indicators of Compromise (1)

CVE (1)
CVE-2026-100390
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

The plaintiffs, who all worked for the independent and Salvadoran news outlet El Faro, failed to convince the court that their case had jurisdiction in California, according to the judge’s order.

The Record
MEDIUMVulnerabilityNEW

RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail

The offensive cyber operations startup looks to evolve red teaming beyond traditional methods to simulate attackers' increasingly advanced capabilities.

Dark Reading
MEDIUMVulnerability

Bipartisan backlash to ALPRs grows as two high-profile bills are introduced

Republican Sen. Josh Hawley has new legislation on limiting automated license plate readers (ALPRs), while Democratic Sens. Bernie Sanders and Jeff Merkley, with Rep. Alexandria Ocasio-Cortez, have teed up a broader bill.

The Record