By Lawrence Abrams
Publication Date: 2026-11-10 16:17:00
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools.
The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie. A CVE identifier and CVSS score have not been assigned yet.
According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
The flaw stems from how Xen Orchestra processes authentication cookies.
By sending a specially crafted cookie (authenticationToken=j:%7B%7D) containing an empty JSON object ({}), attackers can trick the platform into retrieving an existing authentication token and logging them in as its owner, without requiring actual credentials.
Once authenticated, attackers can retrieve “reusable login token IDs” through the /rest/v0/users/me/authentication_tokens REST API endpoint, which can be used for further access.
“An adversary can bypass authentication and perform actions with ‘Admin’ privilege. Xen Orchestra compromise can lead to…
