Xray-core concealed a certificate verification bypass vulnerability

What it is

A first-person disclosure by the researcher who found a certificate verification bypass in Xray-core's pinnedPeerCertSha256 option, with a specific timeline of option changes that turned a defense-in-depth feature into a single point of failure.

How it works

Xray-core originally offered pinnedPeerCertificateChainSha256 (added October 21, 2021), which ran custom certificate chain pinning in addition to regular TLS verification. On January 9, 2026, this was removed and replaced with pinnedPeerCertSha256. On January 16, 2026, Xray-core changed the new option's logic so it always skips regular TLS verification and relies solely on the custom pinning check. Once that change shipped, the custom pinning logic became the only remaining defense — and it contained a flaw: a MITM attacker could insert an arbitrary leaf certificate anywhere in the certificate chain, and the pinning logic would incorrectly validate it, defeating verification entirely.

timeline
    title pinnedPeerCert* option changes
    2021-10-21 : pinnedPeerCertificateChainSha256 added (pinning + regular TLS verification)
    2026-01-09 : Old option removed, replaced by pinnedPeerCertSha256
    2026-01-13 : First release shipping vulnerable pinnedPeerCertSha256
    2026-01-16 : Logic changed to always skip regular TLS verification
    2026-02-06 : Researcher privately reports bypass; silently patched same day ("simplify the code")
    2026-07-03 : Researcher finds fix incomplete; files GitHub Security Advisory

Preconditions / Affected

Users on Xray-core versions from January 13, 2026 onward using pinnedPeerCertSha256 (the only pinning option available after the old one was removed) were exposed once the January 16, 2026 change landed, since that update removed the fallback to regular TLS verification entirely. Users who neither used self-signed certificates nor enabled allowInsecure retained some protection from regular verification only until the January 16 change.

What to do

The page states no user-facing remediation steps (no version number for the fix, no command, no config workaround). It only notes that Xray-core silently patched the bypass on February 6, 2026, and that as of July 3, 2026 a follow-up found the fix itself incomplete — "under certain circumstances, certificate verification could still be bypassed" — prompting a formal GitHub Security Advisory. Readers currently using Xray-core should check the project's Security Advisories directly for the patched version, since this writeup does not supply one.

Caveats

The researcher reports the February fix as incomplete based on their own July 3, 2026 finding; no further detail on the residual bypass conditions or whether it has since been fixed is given in this text.