{"id":4098,"date":"2026-11-10T22:23:49","date_gmt":"2026-11-10T22:23:49","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4098"},"modified":"2026-11-10T22:23:49","modified_gmt":"2026-11-10T22:23:49","slug":"hackers-exploit-critical-xen-orchestra-auth-bypass-flaw-to-gain-admin-access","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4098","title":{"rendered":"Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 10, 2026<\/span><\/span>Vulnerability \/ Cyber Attack<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

French software company Vates VMS has warned<\/a> of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.<\/p>\n

The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062<\/strong>.<\/p>\n

\u00abREST cookie parsing turns authenticationToken=j:%7B%7D into {},\u00bb Vates VMS said in an alert. \u00abREST authentication passes that object to the XO token provider without requiring a string.\u00bb<\/p>\n

\u00abThe token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token’s owner if it is unexpired. The authenticated \/rest\/v0\/users\/me\/authentication_tokens route then returns reusable login token IDs.\u00bb<\/p>\n

In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with \u00abAdmin\u00bb privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.<\/p>\n

Vates VMS said it’s seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain –<\/p>\n