Listen to this Post
The CSRF vulnerability in 1Panel affects versions 1.10.33 through 2.0.15. It targets the Change Username functionality in the settings panel at the endpoint /settings/panel. This endpoint lacks standard CSRF protections such as anti-CSRF tokens or Origin/Referer header validation. An attacker can create a malicious webpage containing a hidden form that submits a POST request to change the username. When a victim, authenticated to the 1Panel interface, visits this page, the victim’s browser automatically includes valid session cookies with the request. The server processes the request as legitimate due to the attached session credentials. This changes the victim’s username to one chosen by the attacker without consent. After the username change, the victim is automatically logged out because the session becomes invalid. The victim cannot log back in with the previous username, leading to account lockout. This results in denial of service, preventing access to the 1Panel administration interface. The attack requires no interaction beyond the victim loading the malicious page. It exploits the trust between the victim’s browser and the vulnerable server. The vulnerability is severe due to the ease of exploitation and the impact of account lockout. It highlights the importance of implementing CSRF defenses in all state-changing operations.
Platform: 1Panel
Version: 1.10.33-2.0.15
Vulnerability: CSRF username change
Severity: High
date: Dec 10 2025
Prediction: Patch date unknown
What Undercode Say:
bash: python3 -m http.server 8000
code:
How Exploit:
Craft malicious HTML page.
Host page online.
Lure victim visit.
Browser auto-submits request.
Username changed silently.
Victim logged out locked.
Protection from this CVE
Implement CSRF tokens.
Validate Origin Referer headers.
Use SameSite cookie attributes.
Require reauthentication for changes.
Impact
Account lockout denial.
Service disruption possible.
Administrative access loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
