Xen Orchestra Cookie Parsing Flaw Hands Attackers First Valid Admin Token
The flaw stems from unsafe deserialization of an empty token object in the XO token provider, a pattern seen in prior REST auth issues. Exploitation is linked to RedLine Stealer infrastructure and enables full hypervisor takeover. Patches in 6.9.1 and 6.10.0 close the vector; unpatched internet-facing instances remain at immediate risk of credential theft and lateral movement.
Vates VMS disclosed active exploitation of an authentication bypass in Xen Orchestra where REST cookie parsing converts the empty JSON object into an unfiltered database lookup. The first matching token is returned and treated as valid, allowing arbitrary actions including VM creation with hvm_serial file redirection for persistence. Indicators include requests with the crafted cookie, a VM named pivot2, and cron jobs at /etc/cron.d/zz-ustar.
Sources (2)
- [1]Vates VMS Security Alert VSA-2026-062(https://vates.fr/security/vsa-2026-062)
- [2]TDC NET Vulnerability Report(https://tdcnet.dk/security/xo-auth-bypass-2026)