tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108899 · Microsoft / collected KEV context

cve-program · CVE-2026-108899

• https://vuldb.com/vuln/416690
• https://vuldb.com/vuln/416690/cti
• https://vuldb.com/cve/CVE-2026-108899
• https://vuldb.com/submit/976047
• https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundary
• https://github.com/tobychui/zoraxy/pull/1291
• https://github.com/tobychui/zoraxy/commit/37cd0f27b17cd15cfa4af409bfec943146f5fdfe
• https://github.com/tobychui/zoraxy/releases/tag/v3.3.5-rc1
• https://github.com/tobychui/zoraxy/

No related operational record is retained in the current change model.