CVE-2025-34410 describes a CSRF vulnerability in LXware 1Panel's Change Username functionality in versions 1.10.33 through 2.0.15. The vulnerability arises because the endpoint does not implement standard CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that, when visited by an authenticated user, submits a forged request to change the user's username. This unauthorized username change logs the victim out and prevents login with the old username, resulting in account lockout and denial of service. The CVSS 4.0 score is 7.0, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on availability.

Successful exploitation allows an attacker to change a victim's 1Panel username without their consent. This causes the victim to be logged out and unable to log in using their previous username, effectively locking the user out of their account and resulting in denial of service. There is no indication of data disclosure or privilege escalation from the provided information.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, administrators should consider restricting access to the Change Username functionality or implementing additional protective measures such as web application firewalls that can detect and block CSRF attempts. Users should be cautious about visiting untrusted websites while authenticated to 1Panel. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.