CVE-2026-79317 in x-ui
Summary
by MITRE • 09/21/2026
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in x-ui version 0.3.2 represents a critical failure in session lifecycle management, specifically concerning credential rotation and token revocation mechanisms. The core technical flaw stems from an over-reliance on client-side signed cookies for authentication state verification. In this architecture, the entire user object, including role privileges such as administrator status, is embedded directly within the cookie payload rather than serving merely as a reference identifier to server-side session data. This design choice fundamentally shifts trust to the integrity of the cryptographic signature and the secrecy of the signing key, while completely bypassing any need for persistent backend state validation during each request cycle. Consequently, once an administrator authenticates successfully, their access rights are effectively immortalized within that specific cookie until it expires naturally or is manually cleared by the user agent, regardless of subsequent changes to the underlying account credentials.
This architectural decision leads directly to a severe session invalidation flaw where administrative actions such as username updates or password resets fail to invalidate existing active sessions. When an administrator modifies their login details, the system does not increment any version counter or update a revocation list that would render previously issued tokens obsolete. Instead, authentication logic simply attempts to deserialize and verify the signature of the incoming cookie. If the cryptographic verification succeeds, the application grants access based on the permissions encoded within that static object. This means that an attacker who has obtained a valid administrative session token prior to a credential change retains full operational control over the management interface indefinitely. The security boundary is thus defined by the lifetime of the client-side storage rather than the current state of the user account, creating a persistent backdoor even after legitimate remediation steps are taken.
The operational impact of this vulnerability is significant for any deployment relying on x-ui as an administrative gateway. An attacker with access to network traffic or local machine storage can capture these signed cookies and utilize them to maintain unauthorized persistence within the system. Since the cookie contains the full user object, it likely includes sensitive metadata such as role assignments, which allows the attacker to escalate privileges if they do not already possess admin rights, although in this specific scenario, the focus is on maintaining existing high-privilege access. The inability to force logout or revoke sessions upon password change undermines basic incident response procedures. In a real-world attack scenario where an administrator suspects compromise and rotates their credentials, this flaw ensures that any previously exfiltrated session tokens remain valid, allowing continued data exfiltration, configuration tampering, or further lateral movement within the managed infrastructure without detection through standard credential monitoring alerts.
From a classification perspective, this vulnerability aligns with CWE-613, Insufficient Session Expiration, and more critically CWE-284, Improper Access Control, due to the failure to enforce current authorization policies against existing tokens. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of persistence through valid credentials that should have been invalidated. The root cause is a design anti-pattern where statelessness is misapplied; while client-side sessions offer scalability benefits by reducing server load, they are inappropriate for high-security administrative interfaces where immediate revocation capability is mandatory. To mitigate this issue, developers must implement server-side session management or introduce a versioning mechanism within the signed token that increments upon credential changes. Additionally, integrating with an external identity provider or implementing short-lived access tokens paired with refresh mechanisms would ensure that privilege checks are dynamically validated against current account states rather than static historical data. Until such architectural corrections are applied, administrators should be advised to clear all browser cookies immediately after any password change and consider restricting the exposure of administrative interfaces to prevent initial token theft in the first place.