Illustrative image: a data centre. Xen Orchestra is server software — no official product photo is freely reusable, so this is a clearly labelled illustration. Image: BalticServers / Wikimedia Commons, CC BY-SA 3.0
TL;DR: The Xen Orchestra auth bypass flaw explained here is VSA-2026-062, a critical bug Vates confirmed on 10 November 2026 that attackers are already exploiting. A cookie carrying an empty token object logs an attacker in as an administrator, with no password needed. Xen Orchestra 6.9.1 and 6.10.0 fix it — update now and check your HTTP logs.
Key Highlights
- Vates published security advisory VSA-2026-062 on 10 November 2026, rating the flaw Critical — and confirmed it is already being actively exploited.
- A specially crafted cookie (
authenticationToken=j:%7B%7D) can log an attacker in as an administrator, with no credentials at all. - No CVE identifier or CVSS score has been assigned yet — but the lack of a CVE number does not make the flaw any less urgent.
- Fixed in Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest). Every earlier version is affected.
- The attack leaves no trace in Xen Orchestra's own logs — detection needs HTTP monitoring, not the admin console.
What happened?
Vates, the French company behind Xen Orchestra, published security advisory VSA-2026-062 on 10 November 2026. The advisory rates the vulnerability Critical and states plainly that it is being actively exploited by a threat actor operating from the IP address 91.211.251.112:8001 and a Tor onion address. BleepingComputer reported the flaw the same day.
The bug was discovered by security researchers Filip Magic and Christoffer Olsen of TDC NET Security. It is a different flaw from the Xen Orchestra authorisation bypass CVE-2026-113610 disclosed in October, which was fixed in version 6.9.0 — this new one affects versions after that fix, so even recently updated installations need the new patch. November is a heavy patching month across the industry: SAP's November 2026 Patch Day alone fixed four flaws rated CVSS 10.0.
Xen Orchestra auth bypass flaw explained: how the empty-token trick works
Xen Orchestra is the web-based management console for XCP-ng virtualisation environments — the screen from which administrators manage virtual machines, hosts and whole pools of servers. Logging in normally requires a username and password, after which the server hands the browser a login token stored in a cookie.
The flaw is in how the server reads that cookie back. When a REST API request arrives carrying the cookie authenticationToken=j:%7B%7D, the server decodes it into an empty JSON object, {} — a token with nothing in it. Instead of rejecting the empty object as invalid, the token lookup treats it as an unfiltered search and returns the first token stored in the system. The attacker is then logged in as whoever owns that token — and the first token on a freshly used system very often belongs to an administrator. No password, no stolen credential, no phishing: just a cookie containing nothing.
Once inside, the attacker can call the /rest/v0/users/me/authentication_tokens endpoint to list reusable login token IDs, cementing access. Vates warns the impact does not stop at the console: an attacker with Admin privilege can run arbitrary code on the managed pools and take over a full XCP-ng node as root — which means every virtual machine on that host.
| Version | Status | What to do |
|---|---|---|
| Xen Orchestra 6.10.0 (latest, xo-server 5.213.1) | Fixed | Already protected — no action needed |
| Xen Orchestra 6.9.1 (stable, xo-server 5.211.2) | Fixed | Already protected — no action needed |
| Xen Orchestra before 6.9.1 (stable) / 6.10.0 (latest) | Affected | Update immediately |
Illustrative image: a data centre server room. Xen Orchestra manages the virtual machines running on servers like these. Image: Wikimedia Commons / Christopher Bowns, CC BY-SA 2.0
Why it matters for India readers
XCP-ng is the open-source hypervisor platform that hosting providers, small cloud operators, colleges and enterprises use to run virtual machines without paying for proprietary virtualisation licences — including in India. Its management console is the single most valuable target in that setup: one successful login can hand an attacker every virtual machine on the host.
No India-specific victims have been named, and the risk here is exposure, not geography. If your Xen Orchestra console is reachable from the internet, assume it is being probed — Vates itself recommends keeping it off the internet entirely, on a dedicated management network. The same week, CISA added four other actively exploited flaws to its known-exploited list — our CISA KEV November 2026 explainer covers those, with a patch deadline of 12 November.
Should you care?
✅ If you run Xen Orchestra, yes — patch today. The fix is a free update to 6.9.1 or 6.10.0, and the flaw is already being exploited. After updating, check your HTTP logs for requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{} — Vates warns the attack leaves no identifiers in Xen Orchestra's own logs, so the web-server logs are where the evidence lives. If the console was ever reachable from the internet, review the token list and rotate credentials. As a longer-term step, move the console behind a VPN or onto a management-only network, and consider a WAF or reverse-proxy rule blocking the empty token (Vates cautions that a simple regex can be bypassed with other encodings, so treat that as a stopgap, not a fix). The IBM Aspera Faspex flaw CVE-2026-123218 is another actively exploited bug with the same 12 November deadline — worth checking in the same patching round.
⏳ If you don't run Xen Orchestra, nothing to do — but the story is a useful reminder of how small the gap between "logged in" and "total compromise" can be when a management console is exposed.
FAQs
What is Xen Orchestra?
Xen Orchestra is the web-based management platform developed by French company Vates for XCP-ng virtualisation environments. Administrators use it to manage virtual machines, hosts and pools of servers from a browser, instead of logging into each host separately.
How does the Xen Orchestra auth bypass work?
An attacker sends a cookie containing an empty JSON object ({}) as the login token. The server treats the empty object as an unfiltered lookup and returns the first stored token, logging the attacker in as that token's owner — often an administrator — without any password or stolen credential.
Which Xen Orchestra versions are affected by VSA-2026-062?
All versions before Xen Orchestra 6.9.1 on the stable channel and before 6.10.0 on the latest channel are affected. The fix is in Xen Orchestra 6.9.1 (xo-server 5.211.2) and 6.10.0 (xo-server 5.213.1), both released on 10 November 2026. No CVE identifier or CVSS score has been assigned yet.
How do I check if my Xen Orchestra server was attacked?
Search your HTTP server logs for requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{}. Vates warns the attack leaves no trace in Xen Orchestra's own logs, so check the web-server logs and review the list of issued authentication tokens for anything unexpected. If the console was internet-facing, rotate tokens and credentials as a precaution.
Takeaway
A cookie containing literally nothing is enough to walk into Xen Orchestra as an administrator — and attackers are already doing it. The patch is free, the update is out, and the only remaining risk is waiting.
If you run Xen Orchestra, check your version now — and if you manage other internet-facing servers, read our CISA KEV November 2026 explainer for the four other flaws attackers are exploiting this week.
Comments
Post a Comment