Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.

The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062.

"REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string."

"The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs."

In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.

Active Exploitation Observed

Vates VMS said it's seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain:

• 91.211.251[.]112:8001, which has been flagged as a RedLine Stealer command-and-control (C2) server on VirusTotal
• ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333

It's unclear when the activity started and if the vulnerability was exploited as a zero-day.

Indicators of Compromise

Other indicators of compromise are listed below:

• HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}
• A running virtual machine named pivot2
• Virtual machines configured using hvm_serial: file parameter
• Suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6

Fixes and Mitigations

The issue has been addressed in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, as well as xo-server versions 5.211.2 and 5.213.1.

If immediate patching is not an option, the following mitigations are advised:

• Avoid exposing Xen Orchestra instances on the internet
• Block the IP address and domain associated with malicious activity
• Block the empty token in a web application firewall (WAF) or a reverse proxy
• Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected

Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security have been credited with discovering and reporting the flaw.