diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php
index 188b47b6..9d83428f 100644
--- a/scripts/pi-hole/php/auth.php
+++ b/scripts/pi-hole/php/auth.php
@@ -17,10 +17,12 @@ function log_and_die($message) {
 function check_cors() {
     $setupVars = parse_ini_file("/etc/pihole/setupVars.conf");
     $ipv4 = isset($setupVars["IPV4_ADDRESS"]) ? explode("/", $setupVars["IPV4_ADDRESS"])[0] : $_SERVER['SERVER_ADDR'];
+    $ipv6 = isset($setupVars["IPV6_ADDRESS"]) ? explode("/", $setupVars["IPV6_ADDRESS"])[0] : $_SERVER['SERVER_ADDR'];
 
     // Check CORS
     $AUTHORIZED_HOSTNAMES = array(
         $ipv4,
+        $ipv6,
         $_SERVER["SERVER_NAME"],
         "pi.hole",
         "localhost"
@@ -40,10 +42,15 @@ function check_cors() {
     // https://pi.hole
     // pi.hole:8080
     // However, we don't use parse_url(...) if there is no colon, since it will fail for e.g. "pi.hole"
-    if(strpos($server_host, ":"))
+
+    // Don't use parse_url for IPv6 addresses, since it does not support them
+    // see PHP bug report: https://bugs.php.net/bug.php?id=72811
+    if(strpos($server_host, ":") && !strpos($server_host, "[") && !strpos($server_host, "]"))
     {
         $server_host = parse_url($_SERVER['HTTP_HOST'], PHP_URL_HOST);
     }
+    // Remove "[" ... "]"
+    $server_host = str_replace(array("[","]"), array("",""), $server_host);
 
     if(isset($_SERVER['HTTP_HOST']) && !in_array($server_host, $AUTHORIZED_HOSTNAMES)) {
         log_and_die("Failed Host Check: " . $server_host .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
@@ -53,10 +60,12 @@ function check_cors() {
         $server_origin = $_SERVER['HTTP_ORIGIN'];
 
         // Detect colon in $_SERVER['HTTP_ORIGIN'] (see comment above)
-        if(strpos($server_origin, ":"))
+        if(strpos($server_origin, ":") && !strpos($server_origin, "[") && !strpos($server_origin, "]"))
         {
             $server_origin = parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST);
         }
+        // Remove "[" ... "]"
+        $server_origin = str_replace(array("[","]"), array("",""), $server_origin);
 
         if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
             log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));