Executive brief
1Panel, an open-source control panel for managing Linux servers and Docker containers, contains a security flaw that allows an attacker to force an administrator to change their own username. By tricking a logged-in administrator into visiting a malicious website, the attacker can silently rename the account. This results in the administrator being immediately logged out and locked out of the system, as they will no longer know the correct username required to log back in.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1Panel settings panel (/settings/panel) specifically within the 'Change Username' functionality. The affected endpoint fails to implement standard CSRF protections such as anti-CSRF tokens or Origin/Referer header validation. An unauthenticated remote attacker can host a malicious webpage that, when visited by an authenticated 1Panel administrator, triggers a background request to change the administrator's username. Successful exploitation results in the victim being forcibly logged out and unable to re-authenticate using their original credentials, effectively causing a permanent account lockout unless manual database intervention occurs. As of the advisory date, the maintainer has not addressed this vulnerability.
Affected products
- LXware 1Panel 1.10.33 - 2.0.15
Timeline
- 2025-12-10: advisory: Initial advisory published by VulnCheck
- 2025-12-10: disclosed: CVE-2025-34410 disclosed