CVE-2025-34410

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-34410
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34410.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-34410
Aliases
Downstream
Related
Published
2025-12-10T16:16:24.793Z
Modified
2026-03-23T05:03:55.240174403Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator
Summary
[none]
Details

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.

References

Affected packages

Git / github.com/1panel-dev/1panel

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/1panel
Events
Introduced
abd3c24562f64d3c70b939c934931d443dae0241
Last affected
7f9f4ae740b8fd80e06bb740a43a13836cc53a85
Database specific 
{
    "versions": [
        {
            "introduced": "1.10.33-lts"
        },
        {
            "last_affected": "2.0.15"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34410.json"