---
id: CVE-2026-79317
title: A session invalidation flaw exists in x-ui 0.3.2
summary: >-
  A session invalidation flaw exists in x-ui 0.3.2. The full user object is
  stored in a client-side signed cookie, and authentication only checks that a
  user object can be retrieved from the cookie without re-validating against the
  databas…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-613
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:00:03.713'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79317'
references:
  - url: 'https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79317.md'
    label: cve@mitre.org
  - url: 'https://github.com/vaxilu/x-ui'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
epss: 0.00287
epssPercentile: 0.18824
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:06:42.767593Z'
ingestedAt: '2026-09-21T20:52:58.302Z'
---

## Overview

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.