CVE-2026-100390Published
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-100390 · Microsoft / collected KEV context
cve-program · CVE-2026-100390
- https://github.com/tobychui/zoraxy/pull/1264
- https://github.com/tobychui/zoraxy/commit/56bb3e5abb83eae42a64203028d73a001d6096c4
- https://github.com/tobychui/zoraxy/blob/v3.3.4/src/mod/auth/sso/forward/util.go#L127-L142
- https://github.com/tobychui/zoraxy
- https://www.vulncheck.com/advisories/zoraxy-3.2.3-through-3.3.4-client-ip-spoofing-via-x-forwarded-for-ipv6
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.