# CVE-2026-79317: x-ui session invalidation flaw in credential change

Source: https://junglewise.ai/threats/cve-2026-79317-a-session-invalidation-flaw-exists-in-x-ui-0-3-2-the-full-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79317 · Severity: medium · CVSS 4.8 · Published 2026-09-21

x-ui is a web-based management panel for administering proxy servers. A flaw in the session handling mechanism allows an attacker who obtained a valid administrator session before a credential change to continue accessing the admin interface even after the administrator rotates their username or password. This could allow a former or compromised user to maintain unauthorized control over the proxy service.

Technologies: [Vaxilu X-Ui](https://junglewise.ai/threats/technologies/x-ui). Vendors: [Vaxilu](https://junglewise.ai/threats/vendors/vaxilu).

## Quick answers

**Is CVE-2026-79317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79317 being exploited in the wild.

**How severe is CVE-2026-79317?** Medium severity, with a CVSS score of 4.8, published 21 September 2026.

**Which products and versions are affected?** Vaxilu X-Ui 0.3.2.

**Is there a fix for CVE-2026-79317?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79317 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79317?** Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insufficient session expiration issue (CWE-613) where session state is entirely client-side in a signed cookie without server-side validation. When administrator credentials are changed, the server does not invalidate previously issued session cookies, and authorization checks do not re-validate the current password or session state against the database. An attacker holding a pre-change admin session cookie can bypass re-authentication and continue accessing the management interface.

## Affected products

- vaxilu x-ui 0.3.2

## Timeline

- 2026-08-04: disclosed
- 2026-09-21: advisory

## References

- [https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79317.md](https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79317.md)
- [https://github.com/vaxilu/x-ui](https://github.com/vaxilu/x-ui)

## Related threats

- [x-ui reflected cross-site scripting in sidebar menu](https://junglewise.ai/threats/cve-2026-79315-a-reflected-cross-site-scripting-vulnerability-exists-in-x-ui-0-3)
- [x-ui horizontal privilege escalation in inbound configuration management](https://junglewise.ai/threats/cve-2026-79314-a-horizontal-privilege-escalation-vulnerability-exists-in-x-ui-0)
- [x-ui improper access control in Xray configuration template](https://junglewise.ai/threats/cve-2026-79316-an-improper-access-control-vulnerability-exists-in-x-ui-0-3-2-any)