CVE-2026-108899 - Vulnerability Details

- tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

Description

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Published: 2026-10-12

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from the function handleBasicAuth in Zoraxy’s Path Exception Matcher, where the PathPrefix argument can be crafted to alter authorization logic. Malicious input can lead to successful authentication for unauthorized requests, effectively bypassing basic authentication controls. This flaw is rooted in improper authentication handling and unauthorized access.

Affected Systems

The issue affects all installations of tobychui’s Zoraxy component up to version 3.3.4, specifically the Path Exception Matcher implementation found in mod/dynamicproxy/authProviders.go. Upgrading to version 3.3.5-rc1 or a later patch that includes commit 37cd0f27b17cd15cfa4af409bfec943146f5fdfe resolves the condition.

Risk and Exploitability

The CVSS base score of 6.9 indicates a moderate severity. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog. Remote exploitation is feasible, and an exploit has already been published, meaning that attackers could leverage it immediately against vulnerable deployments.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

tobychui

zoraxy

affected

Version	Status	Constraints
`3.3.0`	affected	—
`3.3.1`	affected	—
`3.3.2`	affected	—
`3.3.3`	affected	—
`3.3.4`	affected	—
`3.3.5-rc1`	unaffected	—

No data.

Vendor Product Confidence Versions

Tobychui

Zoraxy

100%

Version	Status	Scheme	Platform
`3.3.0`	affected	semver	—
`3.3.1`	affected	semver	—
`3.3.2`	affected	semver	—
`3.3.3`	affected	semver	—
`3.3.4`	affected	semver	—
`3.3.5-rc1`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Zoraxy to version 3.3.5‑rc1 or later to apply the fix for improper authorization.
Review and audit any custom Path Prefix rules in the Path Exception Matcher to ensure proper path boundary enforcement and avoid raw string prefix matches.
Monitor authentication logs for unexpected successful basic authentication events and enforce stricter monitoring on exposed endpoints to detect potential abuse.

Generated by OpenCVE AI on October 12, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00454.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundary
https://github.com/tobychui/zoraxy/
https://github.com/tobychui/zoraxy/commit/37cd0f27b17cd15cfa4af409bfec943146f5fdfe
https://github.com/tobychui/zoraxy/pull/1291
https://github.com/tobychui/zoraxy/releases/tag/v3.3.5-rc1
https://vuldb.com/cve/CVE-2026-108899
https://vuldb.com/submit/976047
https://vuldb.com/vuln/416690
https://vuldb.com/vuln/416690/cti

History

Tue, 13 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 12 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.
Title		tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization
First Time appeared		Tobychui Tobychui zoraxy
Weaknesses		CWE-266 CWE-285
CPEs		cpe:2.3:a:tobychui:zoraxy::::::::
Vendors & Products		Tobychui Tobychui zoraxy
References		https://github.com/carfeii/oss/blob/main/zoraxy.md#finding-1-path-exception-rules-for-basic-auth-zorxauth-and-captcha-match-on-raw-string-prefix-not-a-path-boundary https://github.com/tobychui/zoraxy/ https://github.com/tobychui/zoraxy/commit/37cd0f27b17cd15cfa4af409bfec943146f5fdfe https://github.com/tobychui/zoraxy/pull/1291 https://github.com/tobychui/zoraxy/releases/tag/v3.3.5-rc1 https://vuldb.com/cve/CVE-2026-108899 https://vuldb.com/submit/976047 https://vuldb.com/vuln/416690 https://vuldb.com/vuln/416690/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Tobychui Zoraxy

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-12T15:15:12.313Z

Updated: 2026-10-13T15:20:57.423Z

Reserved: 2026-10-11T14:40:22.646Z

Link: CVE-2026-108899

Vulnrichment

Updated: 2026-10-13T15:20:45.645Z

NVD

Status : Deferred

Published: 2026-10-12T16:17:03.320

Modified: 2026-10-13T16:17:13.060

Link: CVE-2026-108899

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-12T17:00:13Z

Weaknesses

CWE-266
Incorrect Privilege Assignment
CWE-285
Improper Authorization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object