Description

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-21T21:17:12.327Z",
  "pubdate": "2026-09-21T21:17:12.327Z",
  "executiveSummary": "A critical session management vulnerability exists in x-ui 0.3.2 due to improper invalidation of authentication tokens. The application utilizes client-side signed cookies to store the complete user object, failing to verify the integrity of the session against the backend database upon subsequent requests.\nThe vulnerability allows an attacker possessing a pre-existing administrative session cookie to maintain unauthorized access to the management interface even after the administrator has performed a password reset or username modification. Because the authentication mechanism lacks a stateful check or a session versioning system, the application treats outdated, signed cookies as cryptographically valid.\nThis flaw presents a severe security risk, as it effectively nullifies the efficacy of credential rotation and password recovery operations. An attacker who has previously captured or hijacked an admin session retains administrative control over the x-ui instance, enabling potential persistent access and unauthorized system modifications. The vulnerability is exploitable remotely, assuming the attacker has obtained a valid session token, and requires no additional interaction from the administrator once the credential change occurs.",
  "technicalDetails": "The root cause of this vulnerability lies in the stateless authentication implementation of x-ui 0.3.2, which relies exclusively on client-side signed cookies to maintain user state. The application architecture deserializes the user object directly from the cookie without performing a secondary lookup or validation against the underlying identity store (e.g., database) to verify if the session remains authorized.\nSpecifically, the authentication logic fails to verify the session version, last password change timestamp, or any revocation status linked to the user entity stored in the database. As long as the cookie signature remains valid according to the application's secret key, the server-side logic grants access to the management interface regardless of whether the user's credentials have been updated or revoked.\nThe attack flow proceeds as follows: First, an attacker intercepts a valid administrative session cookie during a legitimate session or through unauthorized access to the client machine. Second, the administrator, suspecting a compromise or following security best practices, rotates the account credentials (username or password). Third, the attacker, still possessing the original cookie, attempts to access the management interface. Finally, the application validates the cookie signature, identifies the included user object, and grants the attacker full administrative access because the application does not reference the updated authentication state stored in the backend database.\nThis design choice leads to a permanent session validity window that persists until the application secret key is rotated or the session expiration time (if strictly enforced by the browser) is reached. The lack of a server-side session registry prevents the implementation of centralized session revocation. Consequently, an attacker can maintain long-term access, execute unauthorized configuration changes, and potentially deploy further payloads or bypass access controls within the management console. The vulnerability is inherent to the application's session management component and affects all administrative accounts."
}