Zoraxy versions 3.2.3 through 3.3.4 do not correctly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. This flaw allows an unauthenticated attacker connecting over IPv6 to supply any value in the X‑Forwarded‑For header, thereby forging their source IP address and bypassing the service’s IP‑based access controls that rely on that header. The effect is a complete loss of the intended network‑level restriction, granting the attacker unauthenticated access to protected resources. The weakness is identified as improper authentication, a severe concern for services that use IP checks as a gatekeeper.

The affected product is Zoraxy, a reverse proxy produced by the Tobychui project. Versions 3.2.3 through 3.3.4 are vulnerable, with the fix introduced in later releases. No other products or vendors are listed.

The CVSS score of 9.1 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Based on the description, the attack vector is remote over the network with unauthenticated IPv6 connections; an attacker only needs to craft a request containing a malicious X‑Forwarded‑For header, with no exploitation of local privileges or authentication credentials. The probability of exploitation is uncertain without EPSS data, but the high CVSS suggests a substantial risk for exposed deployments.