← Monday, October 5, 2026SecurityVulnerability

Xray-core faces a certificate-verification bypass allegation

github.com 4 min read Editor score 6/10

A reporter alleges that Xray-core concealed a certificate-verification bypass for half a year, involving its pinned-peer-certificate feature. Proxy users and maintainers should assess whether certificate checks can be bypassed in their own configurations.

What

A vulnerability report alleges that Xray-core's pinnedPeerCertSha256 option can bypass certificate verification.

How

The report says the option always skips regular verification; if custom pinning also fails, no certificate verification remains.

Why it matters

A verification bypass can expose users to man-in-the-middle attacks, so changes to certificate and pinning logic need careful review.

Read on github.com → Hacker News · 10 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.