An open GitHub issue posted on October 2, 2026, was written by someone who identifies themself as the vulnerability reporter. The author alleges that Xray-core's certificate-pinning changes created a bypass and that maintainers fixed an earlier version without notifying users. That account is a reporter's allegation; the issue does not establish the maintainers' intent.
This is the reporter’s public account, not an official finding about the maintainers’ intent.
This is the reporter’s public account, not an official finding about the maintainers’ intent.
The reporter's timeline says Xray-core added certificate-chain pinning in 2021, replaced that option in January 2026, and changed the new option's logic on January 16 so ordinary TLS verification was skipped. The project's January 16 commit is titled ‘Skip TLS built-in verification when using pinnedPeerCert,’ corroborating that code change, but not the reporter's conclusions about its effect on every configuration.
The issue author says they found a certificate-chain bypass on February 6 and privately notified maintainers. The author says a fix and release followed without a security notice. Xray-core's v26.2.6 release page confirms the release date and documents TLS configuration changes; the corresponding commit is titled ‘Simplify cert's verification code.’ Those public records support the timeline and code changes, but do not show whether the lack of a notice was intentional.
A separate Xray-core security advisory, published July 10, confirms that pinning a CA with pinnedPeerCertSha256 can enable man-in-the-middle attacks in some cases. It describes a server-name verification gap in certain Hysteria2 and gRPC paths, rates the issue Low, lists versions from v26.1.13 as affected, and v26.7.11 or later as patched. That is an official confirmation of a related certificate-pinning risk; its described attack condition is not the same as every detail in the reporter's earlier account.
The reporter says a further bypass was found on July 3 and reported through GitHub Security Advisory. The official advisory followed on July 10. Together, the sources establish a technical risk and a public disclosure timeline, while the claim that maintainers concealed the earlier issue remains the reporter's allegation rather than an independently established finding.