CVE-2026-79317: X-ui vulnerability
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
x-uito a version that resolves this vulnerability.Fixed in 0.3.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrators who have issued management-interface session cookies are exposed if an attacker obtains one of those cookies. The risk persists after the administrator changes the username or password because existing cookies are not revoked.
What does an attacker need to exploit it?
The attacker needs a previously issued administrator session cookie. They do not need the administrator's current username or password if the old cookie remains valid.
Does rotating administrator credentials end existing sessions?
No. Changing the administrator username or password does not invalidate previously issued session cookies in the affected version.
How can I tell whether a session may still be active after credential rotation?
Any administrator cookie issued before the username or password change may remain usable. The described authentication behavior accepts a retrievable user object from the signed cookie without checking the database or a session version.