CVE-2026-79317: x-ui Authentication Bypass Vulnerability

CVE-2026-79317 Overview

CVE-2026-79317 is a session invalidation flaw in x-ui version 0.3.2, an Xray panel management interface. The application stores the full user object in a client-side signed cookie. Authentication only verifies that a valid user object can be extracted from the cookie, without re-validating against the database or checking a session version. When an administrator rotates the username or password, previously issued session cookies remain valid. An attacker holding a pre-rotation admin cookie retains access to the management interface after credentials change. The weakness is categorized under [CWE-613: Insufficient Session Expiration].

Critical Impact

Rotated administrator credentials do not revoke existing sessions, allowing attackers with a stolen cookie to retain persistent access to the x-ui management panel.

Affected Products

• x-ui version 0.3.2
• Xray panel management interface by vaxilu
• Deployments relying solely on credential rotation for session revocation

Discovery Timeline

• 2026-09-21 - CVE-2026-79317 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79317

Vulnerability Analysis

The x-ui panel implements session management using a signed cookie that contains the serialized user object. On each request, the application deserializes the cookie, verifies the signature, and treats a successful parse as proof of authentication. No server-side session store, database lookup, or session version field participates in validation.

This design decouples authentication state from the current credential state. Password and username changes only alter database records. They do not invalidate previously issued cookies because the cookies never reference the database during validation. An attacker who obtains an admin cookie through phishing, cross-site scripting, log exposure, or shared workstation access can continue operating the panel after the administrator changes credentials to contain the breach.

Root Cause

The root cause is reliance on cookie signature validity as the sole authentication signal. The application lacks a session version counter, revocation list, or server-side session record. Because the cookie carries all necessary state, credential rotation cannot invalidate outstanding tokens. This matches the pattern described in [CWE-613: Insufficient Session Expiration].

Attack Vector

An attacker first obtains a valid admin session cookie from a compromised endpoint or intercepted traffic. The administrator later detects suspicious activity and rotates the password. The attacker replays the captured cookie against the x-ui panel. The server accepts the cookie, deserializes the embedded user object, and grants full administrative access to Xray configuration, inbound rules, and user management.

No verified proof-of-concept code is published for CVE-2026-79317. Refer to the GitHub advisory for CVE-2026-79317 and the x-ui project repository for implementation context.

Detection Methods for CVE-2026-79317

Indicators of Compromise

• Successful authenticated requests to the x-ui panel using session cookies issued before an administrator credential change
• Administrative actions (inbound creation, user modification, settings changes) originating from IP addresses not associated with the current administrator
• Concurrent active sessions for the same administrator account from geographically distinct sources

Detection Strategies

• Correlate x-ui access logs with the timestamp of the last credential change and flag any authenticated requests using cookies issued before that timestamp
• Monitor for anomalous administrator activity patterns following password reset events
• Review reverse proxy or web server logs for repeated cookie reuse across disparate client fingerprints

Monitoring Recommendations

• Enable verbose access logging on the reverse proxy in front of x-ui, capturing cookie identifiers and source IPs
• Alert on authentication events where the User-Agent or source IP changes for the same session token
• Track administrative configuration changes and require out-of-band confirmation for high-impact operations

How to Mitigate CVE-2026-79317

Immediate Actions Required

• Restart the x-ui service after any credential rotation to force new cookie signing keys and invalidate outstanding sessions
• Restrict panel access to trusted management networks using firewall rules or a VPN
• Rotate the cookie signing secret whenever administrator credentials change, invalidating all issued cookies
• Audit recent administrative activity for signs of unauthorized access

Patch Information

No vendor patch is referenced in the CVE record for x-ui 0.3.2. Review the x-ui project repository for updated releases or forks that address session revocation. Consider migrating to a maintained alternative panel if no fix is published.

Workarounds

• Place x-ui behind an authenticating reverse proxy that maintains its own server-side session state
• Rotate the cookie signing key together with any credential change to force re-authentication of all clients
• Limit administrator sessions with short cookie lifetimes to reduce the replay window
• Bind panel access to specific source IP allowlists to reduce cookie replay opportunities

# Example: rotate signing key by regenerating x-ui database secret and restarting
systemctl stop x-ui
# Backup current database
cp /etc/x-ui/x-ui.db /etc/x-ui/x-ui.db.bak
# Reinitialize secret material per project documentation, then restart
systemctl start x-ui

# Example: restrict panel to management subnet with iptables
iptables -A INPUT -p tcp --dport 54321 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 54321 -j DROP