Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.

The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062 .

"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string."

"The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs."

In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.

Vates VMS said it's seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain -

91.211.251[.]112:8001 , which has been flagged as a RedLine Stealer command-and-control (C2) server on VirusTotal

ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333

It's unclear when the activity started and if the vulnerability was exploited as a zero-day.

Other indicators of compromise are listed below -

HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}

A running virtual machine named pivot2

Virtual machines configured using "hvm_serial: file" parameter

Suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6

The issue has been addressed in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, as well as xo-server versions 5.211.2 and 5.213.1. If immediate patching is not an option, the following mitigations are advised -

Avoid exposing Xen Orchestra instances on the internet

Block the IP address and domain associated with malicious activity

Block the empty token in a web application firewall (WAF) or a reverse proxy

Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected

Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security have been credited with discovering and reporting the flaw.