Tech article
Xray-core concealed a certificate verification bypass vulnerability
No preview is available. Read the original article for the full story.
Hacker News | Oct 4, 2026 | timbill
Automated excerpt
However, pinnedPeerCertSha256 contains a certificate verification bypass vulnerability. On January 13, 2026, Xray-core released the first version containing this certificate verification bypass vulnerability. On January 16, 2026, Xray-core modified the logic of pinnedPeerCertSha256, making it always skip the regular certificate verification and only performs the custom certificate pinning logic.
Selected automatically from source text; not independently written or fact-checked. Read the original for full context.