A flaw has been found in tobychui zoraxy up to 3.3.4. (CVE-2026-108899)
Description
A vulnerability exists in tobychui zoraxy up to version 3.3.4 in the handleBasicAuth function of mod/dynamicproxy/authProviders.go, specifically in the Path Exception Matcher component. The flaw involves improper authorization due to manipulation of the PathPrefix argument and can be exploited remotely. An exploit has been published. Upgrading to version 3.3.5-rc1 addresses the issue.
CVSS v3.1
Score 7.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108899 describes an authorization flaw in tobychui zoraxy versions up to 3.3.4. The vulnerability is located in the handleBasicAuth function within the mod/dynamicproxy/authProviders.go file, part of the Path Exception Matcher component. The issue arises from improper handling of the PathPrefix argument, allowing an attacker to bypass authorization controls remotely. A public exploit exists. The vulnerability is fixed in version 3.3.5-rc1, with the patch identified by commit 37cd0f27b17cd15cfa4af409bfec943146f5fdfe.
Potential Impact
The flaw allows remote attackers to bypass authorization controls by manipulating the PathPrefix argument, potentially leading to unauthorized access and impact on confidentiality, integrity, and availability. The CVSS v3.1 score is 7.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to tobychui zoraxy version 3.3.5-rc1 or later to remediate this vulnerability. This is the official fix provided by the vendor. No other mitigations are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6qcv-qc7g-33wv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108899"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd55582cdf04f656da85b3
Added to database: 10/12/2026, 21:47:04 UTC
Last enriched: 10/12/2026, 22:00:24 UTC
Last updated: 10/13/2026, 03:48:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.