CVE-2025-34410 1Panel CSRF in Change Username Functionality Allows Account Lockout

What is CVE-2025-34410?

CVE-2025-34410 is a high-severity vulnerability in LXware 1Panel, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a username-change request; when a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the victim’s 1Panel username without consent. After the change, the victim is logged out and unable to log in with the previous username, resulting in account lockout and denial of service.

Weakness: CWE-352

Which versions are affected by CVE-2025-34410?

3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.

Products include Fit2cloud 1panel.

How do I fix CVE-2025-34410?

Upgrade to a fixed version.

Is CVE-2025-34410 being exploited?

There is no known exploitation of CVE-2025-34410 in the wild and no public exploit code.

Other vulnerabilities in LXware 1Panel

• CVE-2024-39911 1Panel SQL injection Critical 10.0
• CVE-2024-39907 a sqlinjection in 1Panel Critical 9.8
• CVE-2025-56413 Command injection in n/a High 8.8
• CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution High 8.1
• CVE-2025-66507 1Panel – CAPTCHA Bypass via Client-Controlled Flag High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rpr2-4hqj-hc4q, GO-2025-4229.