Critical Xen Orchestra Authentication Bypass Under Active Exploitation

Overview

• Security researchers Filip Magic and Christoffer Olsen reported the flaw and Vates tracked it as VSA-2026-062 after confirming the bug can bypass Xen Orchestra authentication.
• The bug occurs when a specially crafted cookie (authenticationToken=j:%7B%7D) is parsed into an empty object ({}), causing the token collection to return an existing user's token and authenticate the attacker as that user.
• Vates says the vulnerability is being actively exploited and published indicators of compromise that include connections to 91.211.251.112:8001, a specific .onion address, HTTP requests with the empty-token cookie, a VM named 'pivot2', and suspicious files such as /etc/cron.d/zz-ustar.
• Vates released fixes for Xen Orchestra (6.9.1 and 6.10.0) and patched xo-server packages and advises administrators to update immediately or isolate the management interface, block the empty token at a WAF or reverse proxy, block observed IPs/domains, and rotate all credentials.
• Detection is limited because XCP‑ng host logs do not record the crafted cookie, so defenders must implement HTTP‑level monitoring for the empty-token pattern and consider full reinstallation if compromise is confirmed since attackers can gain admin access and root on hosts.