Is CVE-2025-34410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-34410 being exploited in the wild.

How severe is CVE-2025-34410?

High severity, with a CVSS score of 7.1, published 10 December 2025.

Which products and versions are affected?

github.com/1Panel-dev/1Panel (Go) SEMVER:introduced=0, SEMVER:introduced=1.10.33,last_affected=2.0.15.

Is there a fix for CVE-2025-34410?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-34410 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-34410?

Check whether you run github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34410: LXware 1Panel CSRF in Change Username functionality

CVE-2025-34410 · Severity: high · CVSS 7.1 · Published 2025-12-10

1Panel, an open-source control panel for managing Linux servers and Docker containers, contains a security flaw that allows an attacker to force an administrator to change their own username. By tricking a logged-in administrator into visiting a malicious website, the attacker can silently rename the account. This results in the administrator being immediately logged out and locked out of the system, as they will no longer know the correct username required to log back in.

Technologies: github.com/1Panel-dev/1Panel (Go). Vendors: Go.

Quick answers

Is CVE-2025-34410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-34410 being exploited in the wild.
How severe is CVE-2025-34410?: High severity, with a CVSS score of 7.1, published 10 December 2025.
Which products and versions are affected?: github.com/1Panel-dev/1Panel (Go) SEMVER:introduced=0, SEMVER:introduced=1.10.33,last_affected=2.0.15.
Is there a fix for CVE-2025-34410?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-34410 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-34410?: Check whether you run github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1Panel settings panel (/settings/panel) specifically within the 'Change Username' functionality. The affected endpoint fails to implement standard CSRF protections such as anti-CSRF tokens or Origin/Referer header validation. An unauthenticated remote attacker can host a malicious webpage that, when visited by an authenticated 1Panel administrator, triggers a background request to change the administrator's username. Successful exploitation results in the victim being forcibly logged out and unable to re-authenticate using their original credentials, effectively causing a permanent account lockout unless manual database intervention occurs. As of the advisory date, the maintainer has not addressed this vulnerability.

Affected products

LXware 1Panel 1.10.33 - 2.0.15

Identifiers

CVE-2025-34410
GHSA-rpr2-4hqj-hc4q
GO-2025-4229

Timeline

2025-12-10: advisory: Initial advisory published by VulnCheck
2025-12-10: disclosed: CVE-2025-34410 disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.