Executive brief
x-ui is a web-based management panel for administering proxy servers. A flaw in the session handling mechanism allows an attacker who obtained a valid administrator session before a credential change to continue accessing the admin interface even after the administrator rotates their username or password. This could allow a former or compromised user to maintain unauthorized control over the proxy service.
Technical details
The vulnerability is an insufficient session expiration issue (CWE-613) where session state is entirely client-side in a signed cookie without server-side validation. When administrator credentials are changed, the server does not invalidate previously issued session cookies, and authorization checks do not re-validate the current password or session state against the database. An attacker holding a pre-change admin session cookie can bypass re-authentication and continue accessing the management interface.
Affected products
- vaxilu x-ui 0.3.2
Timeline
- 2026-08-04: disclosed
- 2026-09-21: advisory