Crafted cookie lets attackers bypass Xen Orchestra login and take over virtualization hosts
A specially crafted authentication cookie can let remote attackers log into Xen Orchestra as an administrator and seize XCP-ng virtualization hosts, Vates warns in a critical advisory reported by BleepingComputer.
- Affected
- Affected version range not specified by supplied evidence.
- Fixed
- Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest); xo-server 5.211.2 and 5.213.1.
Attackers need only network access to the management interface; no credentials are required. Sending authenticationToken=j:{} tricks the platform into retrieving an existing token and logging the requester in as its owner. They can then pull reusable login token IDs from a REST API endpoint.
Vates warns compromise can lead to arbitrary code execution and full XCP-ng node takeover as root. The flaw is actively exploited, though no CVE or CVSS score has been assigned. Fixed releases are Xen Orchestra 6.9.1 stable and 6.10.0 latest, with patched xo-server packages 5.211.2 and 5.213.1.
Because crafted cookies leave no log identifiers, attacks must be detected through HTTP monitoring. Vates urges immediate updates and, where patching is impossible, restricting the interface to dedicated management networks and blocking known malicious IPs; suspected victims should rotate passwords and secrets.
Sources & technical scope 1 source
BleepingComputer — original source ↗
Affected: Affected version range not specified by supplied evidence.
Fixed: Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest); xo-server 5.211.2 and 5.213.1.
Exploitation: Actively exploited per Vates; no CVE or CVSS assigned as of 2026-11-12.
Scope & limitations: No CVE/CVSS assigned; affected versions not specified; IOCs associated only with the known campaign; crafted cookies leave no log identifiers, so HTTP monitoring is the stated detection method.
External findings belong to the credited researchers.