Threats tagged 'ghsa-m43c-83cc-q6q2'

CVE-2026-79317 is a session invalidation vulnerability in x-ui version 0.3.2. The application stores the full user object in a client-side signed cookie and only verifies the presence of this cookie without revalidating the session against the database or session version. This flaw allows an attacker holding a pre-change administrator cookie to maintain access to the management interface even after the administrator changes their username or password.