CVE-2025-34410

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-34410

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34410.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-34410

Aliases

Downstream

SUSE-SU-2026:0037-1

openSUSE-SU-2026:21483-1

Related

Published

2025-12-10T16:07:08.530Z

Modified

2026-08-12T03:51:48.293323700Z

Severity

7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

1Panel CSRF in Change Username Functionality Allows Account Lockout

Details

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.

Database specific

{
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/34xxx/CVE-2025-34410.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/1panel-dev/1panel

Affected ranges

Type

GIT

Repo

https://github.com/1panel-dev/1panel

Events

Introduced

abd3c24562f64d3c70b939c934931d443dae0241

Last affected

7f9f4ae740b8fd80e06bb740a43a13836cc53a85

Database specific

Show details

{
    "cpe": "cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "1.10.33"
        },
        {
            "last_affected": "2.0.15"
        },
        {
            "introduced": "1.10.33-lts"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34410.json"