French software company Vates VMS warned that a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062 and not yet assigned a CVE, is being actively exploited in the wild. The vulnerability stems from REST cookie parsing that turns authenticationToken=j:%7B%7D into an empty object, which the XO token provider accepts without a string and then returns the first unexpired token, granting "Admin" privileges. Exploitation allows arbitrary code execution on managed pools and full XCP-ng node takeover as root. Vates VMS observed activity from IP 91.211.251[.]112:8001 and TOR domain ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333, flagged as a RedLine Stealer C2 server. The issue is fixed in Xen Orchestra 6.9.1, 6.10.0 and xo-server 5.211.2, 5.213.1; mitigations include avoiding internet exposure, blocking the malicious IP/domain, and filtering the empty token. 1