CVE-2025-34410: 1Panel CSRF in Change Username Functionality Allows Account Lockout
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
1Panelto a version that resolves this vulnerability.Fixed in 2.0.15 - Configuration
Enable CSRF protections for the Change Username endpoint by implementing anti-CSRF tokens and validating Origin/Referer to prevent cross-site requests using a victim’s session cookies.
1Panel (Change Username functionality in settings panel /settings/panel) CSRF protections = Add anti-CSRF tokens and enforce Origin/Referer validation - Compensating control
Restrict access to the 1Panel settings panel endpoint (/settings/panel) so only trusted users/sessions can reach the Change Username functionality (e.g., via network access control/ACL or firewall rules).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34410?
CVE-2025-34410 is classified as a medium severity vulnerability due to its potential for exploitation via Cross-Site Request Forgery in the Change Username functionality.
How do I fix CVE-2025-34410?
To fix CVE-2025-34410, implement anti-CSRF tokens and validate the Origin/Referer headers in the Change Username functionality.
What versions of 1Panel are affected by CVE-2025-34410?
CVE-2025-34410 affects 1Panel versions between 1.10.33 and 2.0.15.
What type of vulnerability is CVE-2025-34410?
CVE-2025-34410 is a Cross-Site Request Forgery (CSRF) vulnerability.
Where is the vulnerability located in 1Panel for CVE-2025-34410?
The vulnerability is located in the Change Username functionality within the settings panel at the endpoint /settings/panel.