1. Basic Information

  • Article Name: VSA-2026-062: Empty-object login token
  • Publisher: Vates
  • Publication Date: 2026-11-10
  • Collection Date: 2026-11-11T07:47:50+09:00
  • Source: Vates
  • Related Source: BleepingComputer: Xen Orchestra auth bypass exploited
  • Related Malware: None specified
  • Related Threat Groups: None specified
  • Related CVE: None specified
  • Related Products and Technologies: Xen Orchestra, Xen Orchestra Appliance, XCP-ng
  • Severity: Critical
  • Severity Rationale: A cookie supplied before authentication can allow an attacker to authenticate as an existing token owner. Vates has confirmed active exploitation and published IOCs, including persistence files. Potential impacts include code execution on managed pools and root takeover of XCP-ng hosts.

2. Quick Summary

An empty JSON object in a REST cookie triggers an unfiltered lookup that returns the first token in the collection. If that token is unexpired, the attacker is authenticated as its owner. Attackers can operate with the owner's privileges and obtain reusable login token IDs from post-authentication APIs. If the owner has Administrator privileges, this can lead to code execution on managed pools and root takeover of XCP-ng hosts. Vates has confirmed active exploitation.

3. Attack Flow

  1. Send authenticationToken=j:%7B%7D or j:{} to the management interface.
  2. The cookie parser creates an empty object, causing the token collection to return the first token via an unfiltered lookup. If that token is unexpired, the attacker is authenticated as its owner.
  3. Obtain reusable token IDs from the post-authentication authentication_tokens endpoint (obtaining the ID itself is not a privilege escalation).
  4. Operate VMs and pools with the owner's privileges (if Administrator), potentially leading to arbitrary code execution in the managed pool and root takeover of XCP-ng nodes, as described by Vates. Vates has published IOCs associated with the identified exploitation campaign, including persistence files.

4. Attacker Position and Execution Location

  • An unauthenticated remote attacker with network reachability to the Xen Orchestra REST or management interface.

5. Victim and Administrator Perspectives

Victim Side

  • May manifest as VM stops or modifications, service disruption, and data access.

Administrator Side

  • Visible through HTTP monitoring of empty-token cookies, pivot2 VMs, hvm_serial:file, cron and root files, and IOC network traffic.

6. Success and Failure Conditions

Success Conditions

  • The attacker must be able to reach an unpatched Xen Orchestra or XOA management interface. The fixed Xen Orchestra versions are 6.9.2 for the stable channel and 6.10.1 for the latest channel.
  • Authentication bypass requires the first token in the collection to be unexpired. Performing Administrator actions additionally requires that token's owner to have Administrator privileges.

Failure Conditions and Mitigations

  • For the stable channel, update to Xen Orchestra 6.9.2 / xo-server 5.211.2 or later. For the latest channel, update to Xen Orchestra 6.10.1 / xo-server 5.213.1 or later.
  • Do not expose the management interface to the internet; place it on a dedicated management network.

(For responses when a compromise is confirmed, refer to containment in Section 10: rotate all Vates VMS secrets and perform the full reinstallation recommended by Vates.)

7. What Happens Upon Success

  • Authentication bypass as an existing token owner, and acquisition of reusable token IDs from post-authentication APIs (operating under the token owner's privileges).
  • Arbitrary code execution on managed pools.
  • Root takeover of XCP-ng nodes, credential harvesting, and persistence.

8. Observable Logs

  • Email: No specific observation points published.
  • Proxy/SWG/DNS: Communications to onion C2 and IOC IP addresses.
  • Endpoint/EDR: /etc/cron.d/zz-ustar*, /.ustar5, /.ustar6, /etc/ld.so.preload.
  • Identity/IdP: Token usage and token enumeration that do not correspond to normal logins (investigation candidates verifiable if HTTP requests are recorded; no specifications indicate logging on the IdP side).
  • SaaS/Cloud: VM configurations including pivot2 VMs and hvm_serial:file. In addition to current VM configuration checks, investigation candidates include reviewing related records in retained /var/log/xensource.log* files (XO authentication bypass access itself leaves no detection logs).
  • Network: HTTP requests containing empty-token cookies. Vates states that successful unauthenticated access itself is not logged in XO logs.

9. Attack Success Determination

Confirmed Subsequent Compromise

  • Published Information: Vates confirmed active exploitation and published root persistence files, pivot2 VMs, and C2 infrastructure as IOCs.
  • Confirmation Scope: Within the campaign scope identified by Vates; IOCs from other actors may differ. Detailed execution timelines for each step have not been publicly disclosed.

10. Investigation Playbook

  • Trigger: Empty-token cookies, pivot2 VMs, hvm_serial:file, and published IOCs.
  • Initial Verification: Check versions, exposure, HTTP captures, VM inventories, and host files.
  • Endpoint: Preserve cron jobs, ld.so.preload, root files, processes, and network connections on XCP-ng hosts.
  • Authentication & Cloud: Check login tokens, users, Administrator actions, and backup remote credentials.
  • Subsequent Actions: Investigate VM exports, secret theft, host commands, and lateral movement.
  • Containment: Isolate networks, update systems, block IOCs, rotate secrets, and perform reinstalls in confirmed compromises.
  • Decision Categories: Separate exploit requests, token acquisition, Administrator actions, host root access, and persistence.

11. Defense and Detection Ideas

  • Single Event: Detect empty-token cookies via reverse proxies or WAFs.
  • Timeline Correlation: Correlate cookie requests -> token endpoints -> VM creation/modification -> host persistence -> C2 (when HTTP captures or similar records are available).
  • Hunting: Search all pools for pivot2, hvm_serial:file, zz-ustar*, and .ustar*.
  • Log Limitations: Successful unauthenticated access is not recorded in XO logs and cannot be traced without HTTP captures.
  • Priority Controls: Prioritize immediate updates, management network segmentation, secret rotation, and full reinstallation decisions.

12. Facts / Inference / Hypothesis

Facts

  • authenticationToken=j:%7B%7D is parsed as an empty object, and an unfiltered token lookup returns the first token.
  • An unauthenticated attacker can authenticate as the owner of an existing token and operate with that owner's privileges. Reusable login token IDs can also be obtained from post-authentication APIs (the token owner must have Administrator privileges for the attacker to perform Administrator actions).
  • Vates confirmed active exploitation of the vulnerability.
  • Compromises can progress to code execution in managed pools and root takeover of XCP-ng nodes.
  • Patched versions are Xen Orchestra 6.9.2 / xo-server 5.211.2 for stable and Xen Orchestra 6.10.1 / xo-server 5.213.1 for latest.

Inference

  • Exposing the management plane to the internet expands the blast radius from a single authentication bypass to the entire virtualization estate.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Exploitation of token processing flaws in the management interface prior to authentication.
T1078 Valid Accounts high Authentication as the owner of an acquired existing token.
T1053.003 Scheduled Task/Job: Cron high Cron files indicating root persistence have been published as IOCs.

14. Unknowns and Further Investigation

  • The number of victim organizations, initial target selection, complete attack commands, and stolen data have not been published.

15. Impact on SOCs and Organizations

Compromise of the virtualization management plane simultaneously affects numerous virtual machines and backup credentials. Organizations operating XCP-ng and Xen Orchestra should immediately verify not only their software versions but also management interface exposure and host IOCs.

16. Summary by Target Audience

  • For SOCs: Correlate empty-token cookies with host and VM IOCs.
  • For Administrators: Update to version 6.9.2 / 6.10.1 or later and isolate the management interface to a dedicated network.
  • For Users: No user action is required. Follow administrator guidance in the event of service disruptions.