Xen Orchestra is a web-based management platform developed by French software company Vates, used to manage XCP-ng virtualization environments, including virtual machines, hosts, and pools. The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a specially crafted cookie.
A CVE identifier and CVSS score have not been assigned yet. According to a Vates security advisory, the flaw stems from how Xen Orchestra processes authentication tokens sent through REST API requests.
The flaw stems from how Xen Orchestra processes authentication cookies. By sending a specially crafted cookie (authenticationToken=j:%7B%7D) containing an empty JSON object ({}), attackers can trick the platform into retrieving an existing authentication token and logging them in as its owner, without requiring actual credentials.
