TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A vulnerability reporter alleges that Xray-core silently fixed a certificate-pinning verification bypass on February 6, 2026, without disclosing the security issue to users. The reporter says a related bypass remained and was submitted through a GitHub Security Advisory on July 3; the supplied report does not include a maintainer response or advisory details.
A vulnerability reporter says Xray-core silently fixed a certificate-verification bypass on February 6, 2026, but released the change without telling users it addressed a security flaw. The reporter says a further bypass remained in the fix and was submitted through a GitHub Security Advisory on July 3; the account raises questions about whether users were told to update and how long affected configurations were exposed.
In a report posted to the net4people GitHub forum, the reporter describes a flaw in Xray-core’s pinnedPeerCertSha256 option, which was introduced in January 2026. According to the report, an attacker positioned to intercept a connection could insert a leaf certificate into the certificate chain at a location that caused the custom pinning check to accept it. The reporter says this could enable a man-in-the-middle attack, in which an attacker intercepts or alters communications.
The reporter says they privately notified Xray-core maintainers on February 6. The same day, maintainers changed the code and issued a new release, but the reporter says the commit message described the change as code simplification rather than identifying a security fix. The source provides no release number, affected-version range, commit link, or maintainer response, so those details cannot be independently established from the supplied material.
The account says the reporter found the February fix incomplete on July 3, with verification still bypassable under certain circumstances. They say they then used a GitHub Security Advisory to report the remaining issue, partly to prevent what they viewed as another silent fix. The supplied source does not give the advisory identifier, technical reproduction details, or the status of that report.
Risks for Pinned Certificate Users
Certificate verification helps a client determine whether it is communicating with the intended server rather than an impostor. A bypass in a proxy client can weaken that protection for users whose connections rely on the affected option, making interception risk the central concern in the report.
The alleged disclosure gap matters separately from the code defect. If users are not told that a release fixes a security problem, they may have little reason to install it promptly or check whether their configuration is affected. A public security notice typically helps users identify vulnerable versions, understand the impact, and prioritize updates. The reporter’s account alleges that this information was absent from the February release; the supplied material does not establish how many users were affected or whether anyone was attacked.
The issue also involves a design trade-off around self-signed certificates. Pinning can allow a client to trust a specified certificate without relying on ordinary certificate authorities, but it must be implemented correctly. The reporter argues that Xray-core’s option changes removed a separate layer of ordinary verification, leaving the pinning logic as the remaining safeguard. That description is the reporter’s assessment, not an independently verified audit finding.
Products Worth Considering
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Space Black
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Pinning Option Changed
The report traces the configuration back to October 21, 2021, when Xray-core added pinnedPeerCertificateChainSha256. According to the reporter, that option performed custom certificate-chain pinning in addition to regular certificate verification. They say users could combine it with allowInsecure for self-signed certificates, relying on pinning while skipping ordinary verification.
On January 9, 2026, Xray-core removed the older option and replaced it with pinnedPeerCertSha256. The reporter says the replacement was intended to discourage users from bypassing standard verification, while still supporting self-signed certificates when paired with allowInsecure. They say the first release containing the new option appeared on January 13, and that a January 16 logic change made it skip regular verification in all cases.
The reporter’s timeline says the February 6 patch addressed the initial bypass, but did not fully resolve the problem later found under some conditions. These dates and descriptions come from the person who reported the vulnerability. The supplied source does not include code review, an independent technical analysis, or a statement from Xray-core confirming the sequence.
“The commit message claimed it was to “simplify the code.””
— The vulnerability reporter, describing the February 6 commit
Affected Releases and Advisory Status
The supplied report does not identify the vulnerable release range, the version containing the February fix, or whether a later release addresses the July finding. It also does not include the GitHub Security Advisory number or reproduce the remaining bypass conditions. Those omissions mean readers cannot determine from this material alone whether a particular installation is vulnerable or which version to use.
There is no response from Xray-core maintainers in the source material, and the allegations about concealment and the technical impact have not been independently verified here. The reporter says users remained exposed for nearly half a year, but provides no user counts, evidence of exploitation, or incident reports. It is not clear whether attackers used the flaw in real-world attacks.
Disclosure and Patch Details Needed
The next concrete step is publication or confirmation of the July advisory, including affected versions, the conditions required to trigger the bypass, and any corrected release. Xray-core maintainers have not provided a response in the material available for this report, so it is unknown whether they plan to issue a security notice or further patch.
Users should consult Xray-core’s official release notes and security channels for confirmed version guidance rather than relying on the reporter’s account alone. A maintainer statement, the advisory’s technical details, and an independent review would clarify whether the February change fully fixed the original bug, what remains affected, and how urgently users should update.
Key Questions
What vulnerability does the report describe?
The reporter says Xray-core’s pinnedPeerCertSha256 option could accept a certificate chain manipulated by an attacker, potentially bypassing verification and enabling a man-in-the-middle attack. The technical claim has not been independently confirmed in the supplied material.
When was the issue reported and fixed?
The reporter says they privately reported the initial issue and Xray-core changed the code on February 6, 2026. They allege the change was not identified publicly as a security fix. On July 3, they reported finding a remaining bypass and filed a GitHub Security Advisory.
Which Xray-core versions are affected?
The supplied report does not specify an affected-version range or identify a confirmed release that fixes the July finding. Users should check official Xray-core release notes and security advisories for version-specific guidance.
Is there evidence the vulnerability was exploited?
The source material does not describe confirmed attacks, affected users, or exploitation in the wild. The reporter warns that the flaw could allow interception, but whether anyone used it remains unknown.
Source: hn
