Kodem Security archive entry for Xray-core GHSA-5WF9-H793-W73C.
Summary: High-severity vulnerability in pinnedPeerCertSha256 allowing MITM when pinning a CA certificate. Attacker issues leaf cert through pinned Root CA; empty ServerName with InsecureSkipVerify bypasses hostname checks.
Affected: github.com/xtls/xray-core versions >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9.
Fix: upgrade to 1.260327.1-0.20260710210335-64fada32b5b9 or later.
Technical root cause: Go TLS requires either ServerName or InsecureSkipVerify; pinning path forces InsecureSkipVerify=true; IP-based connections leave ServerName empty, disabling hostname verification against pinned CA chains.