CVE-2025-34410
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality. The endpoint lacks CSRF protections like anti-CSRF tokens or Origin/Referer validation, allowing an attacker to change the victim's username without consent.
Risk Assessment
An attacker can hijack the victim's account by changing their username, causing logout and preventing re-login. This results in account lockout and denial of service to the administrative panel.
Recommendation
Upgrade 1Panel to version 2.0.16 or later, which includes a fix for the CSRF vulnerability. Until the update is applied, implement server-side Origin/Referer header validation as a temporary mitigation.
Other vulnerabilities in 1Panel
See all- CVE-2025-34430Medium
CSRF vulnerability in 1Panel versions 1.10.33 through 2.0.15 in the panel name management functionality. Lack of CSRF defenses (tokens, Origin/Referer validation) allows an attacker to change the victim's panel name without consent via a crafted webpage.
- CVE-2025-34429High
CSRF vulnerability in 1Panel versions 1.10.33 to 2.0.15 in the web port configuration functionality. The port-change endpoint lacks CSRF defenses (tokens, Origin/Referer validation), allowing an attacker to change the listening port, causing loss of access on the original port and potentially exposing the service on an attacker-chosen port.
- CVE-2023-39966High
In version 1.4.3 of the 1Panel, there is an arbitrary file write vulnerability that could lead to direct control of the server. The issue arises from a lack of parameter filtering in the `SaveContent` function in the `api/v1/file.go` file.
- CVE-2023-39965Medium
In version 1.4.3 of the 1Panel, authenticated attackers can download arbitrary files through the API interface, leading to unauthorized access. This may result in significant information leakage.
- CVE-2023-39964High
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, there is a vulnerability that allows an attacker to read arbitrary important configuration files on the server due to unfiltered request parameters.
- CVE-2023-36458Medium
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker could craft malicious payloads to achieve command injection when entering the container terminal.
- CVE-2023-36457Medium
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.
Original NVD description (English source)
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.