"REST cookie parsing turns authenticationToken=j:%7B%7D into {{}}," Vates VMS said in an alert.
Vates VMS identifies a critical Xen Orchestra authentication bypass (VSA-2026-062)
French vendor Vates VMS warned of a critical authentication-bypass vulnerability in Xen Orchestra tracked as VSA-2026-062. The vendor said the flaw is being actively exploited in the wild and that the defect does not yet have a CVE identifier. Vates described how a malformed REST cookie can be parsed into an object that circumvents normal token checks and leads to elevated privileges.
How the authentication bypass works, as described by Vates VMS
Vates VMS explained the technical chain: REST cookie parsing turns a cookie value of authenticationToken=j:%7B%7D into an empty object ({{}}). "REST authentication passes that object to the XO token provider without requiring a string," the company wrote. The token collection then treats {{}} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs.
In plain terms from the vendor's description, a specially crafted cookie can allow an attacker to bypass authentication, acquire "Admin" privileges and perform arbitrary actions. Vates warned that successful exploitation can result in arbitrary code execution on managed pools and a full XCP-ng node takeover as root.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageActive exploitation, indicators of compromise, and attacker infrastructure
Vates reported active exploitation tied to a threat actor using the IP 91.211.251[.]112:8001 and a Tor endpoint at ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333. The IP has been flagged on VirusTotal as a RedLine Stealer command-and-control (C2) server.
- HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{{}}
- A running virtual machine named pivot2
- Virtual machines configured using the "hvm_serial: file" parameter
- Suspicious files at /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6
Vates said it is unclear when the malicious activity began and whether the vulnerability was exploited as a zero-day.
Patches issued and mitigations when immediate patching is not possible
Vates VMS released fixes in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, and in xo-server versions 5.211.2 and 5.213.1. For teams that cannot patch immediately, the vendor recommended several mitigations:
- Avoid exposing Xen Orchestra instances directly on the internet.
- Block the cited IP address and Tor domain associated with malicious activity.
- Block the empty token in a web application firewall (WAF) or reverse proxy.
- Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected.
What this means for technologists and affected enterprises
Technologists and security teams: validate whether Xen Orchestra instances are internet-exposed, scan logs for the listed HTTP cookie patterns and pivot2 VMs, and apply the vendor patches (Xen Orchestra 6.9.1 / 6.10.0 or xo-server 5.211.2 / 5.213.1). If compromise indicators appear, follow the vendor's advice to rotate credentials and harden perimeter controls such as WAFs or reverse proxies.
Affected enterprises and procurement leaders: review deployment exposure and inventory Xen Orchestra versions in use. If immediate upgrades are not possible, isolate affected management planes, block the reported IP and Tor endpoints, and require token-filtering rules at network edges according to Vates' mitigations.
Vates credited Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security with discovering and reporting the flaw.
It remains unclear how long the exploit campaign has been running and whether attackers first used this flow as a zero-day; the vendor's advisory leaves that timing question open while describing active abuse and practical mitigations for defenders.
