CVE-2026-79317

Deferred Deferred - Pending Action

Session Fixation in x-ui 0.3.2

Publication date: 2026-09-21

Last updated on: 2026-09-22

Assigner: MITRE

Description

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-22

Generated

2026-10-12

AI Q&A

2026-09-22

EPSS Evaluated

2026-10-10

NVD

CVE-2026-79317

EUVD

EUVD-2026-84149

Affected Vendors & Products

Vendor	Product	Version / Range
vaxilu	x-ui	to 0.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

This vulnerability is a session invalidation flaw in x-ui version 0.3.2. It allows an attacker to maintain access to the management interface even after an administrator changes their username or password. This happens because the full user object is stored in a client-side signed cookie, and authentication only verifies the cookie's presence without checking against the database or session version.

Detection Guidance

Check for x-ui 0.3.2 installations by searching for the application files or processes. Inspect client-side cookies for large signed user objects. Monitor for unauthorized access to the management interface after credential changes.

Impact Analysis

If you are an administrator using x-ui 0.3.2, an attacker who obtains your session cookie before you change your credentials could continue accessing your management interface even after you update your username or password. This could lead to unauthorized actions, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized access risks data breaches, loss of data integrity, and failure to meet security and privacy controls mandated by these standards.

Mitigation Strategies

Upgrade x-ui to a patched version if available. Rotate all admin credentials and manually invalidate all active sessions. Implement server-side session validation to ensure cookies are re-validated against the database.

Hi! I’m here to help you understand CVE-2026-79317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70