CVE-2026-79317 Details

A session invalidation vulnerability has been identified in x-ui version 0.3.2. This issue arises because the full user object is stored in a client-side signed cookie. Authentication processes only verify that a user object can be retrieved from the cookie, without re-validating against the database or checking any session version. Consequently, when an administrator changes the username or password, previously issued session cookies remain active. This allows an attacker with a pre-change admin cookie to continue accessing the management interface even after the credentials have been updated.

As of the report date, there is no official patch available for this vulnerability. However, it is recommended to manually rotate the session signing material after any credential change, require all administrators to log in again, shorten session lifetimes, and monitor for old sessions that continue to access management interfaces after a credential change.