{"id":"CVE-2026-79317","title":"A session invalidation flaw exists in x-ui 0.3.2","summary":"A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the databas…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-613"],"published":"2026-09-21","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:00:03.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79317","references":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79317.md","label":"cve@mitre.org"},{"url":"https://github.com/vaxilu/x-ui","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"epss":0.00186,"epssPercentile":0.08487,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-22T14:06:42.767593Z"},"ingestedAt":"2026-09-21T20:52:58.302Z","slug":"CVE-2026-79317","body":"## Overview\n\nA session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":209104,"id":"CVE-2026-79317","ts":1790089539404,"field":"cvss","old":null,"new":"4.8"},{"seq":209103,"id":"CVE-2026-79317","ts":1790089539404,"field":"severity","old":"none","new":"medium"}]}