{"record":{"id":"b052fb4fbb3bae6f","repo":"XTLS/Xray-core","slug":"vless-users-unsupported-encryption-account-en","errorCode":null,"errorMessage":"VLESS users: unsupported \"encryption\": {account.Encryption}","messagePattern":"VLESS users: unsupported \"encryption\": (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/vless.go","lineNumber":374,"sourceCode":"\t\t\t\t\tif len(r) < 20 {\n\t\t\t\t\t\tpadding += len(r) + 1\n\t\t\t\t\t\tcontinue\n\t\t\t\t\t}\n\t\t\t\t\tif b, _ := base64.RawURLEncoding.DecodeString(r); len(b) != 32 && len(b) != 1184 {\n\t\t\t\t\t\treturn false\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\taccount.Encryption = account.Encryption[27+len(s[2]):]\n\t\t\t\tif padding > 0 {\n\t\t\t\t\taccount.Padding = account.Encryption[:padding-1]\n\t\t\t\t\taccount.Encryption = account.Encryption[padding:]\n\t\t\t\t}\n\t\t\t\treturn true\n\t\t\t}() && account.Encryption != \"none\" {\n\t\t\t\tif account.Encryption == \"\" {\n\t\t\t\t\treturn nil, errors.New(`VLESS users: please add/set \"encryption\":\"none\" for every user`)\n\t\t\t\t}\n\t\t\t\treturn nil, errors.New(`VLESS users: unsupported \"encryption\": ` + account.Encryption)\n\t\t\t}\n\n\t\t\tuser.Account = serial.ToTypedMessage(account)\n\t\t\tspec.User = user\n\t\t\tbreak\n\t\t}\n\t\tconfig.Vnext = spec\n\t\tbreak\n\t}\n\n\treturn config, nil\n}\n","sourceCodeStart":356,"sourceCodeEnd":387,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/vless.go#L356-L387","documentation":"Thrown by VLessOutboundConfig.Build() when a user's \"encryption\" value is neither \"none\", empty (covered by the friendlier sibling error), nor a syntactically valid post-quantum spec of the form mlkem768x25519plus.<mode>.... The validator splits on '.', requires the 'mlkem768x25519plus' prefix plus at least 4 segments with a known mode (native/xorpub/random) and well-formed key/padding segments; anything else — e.g. \"auto\", \"aes-128-gcm\" — falls through to this error. Those AEAD values are VMess concepts and do not exist in VLESS.","triggerScenarios":"\"encryption\":\"auto\" or \"aes-128-gcm\" copied from a VMess account; \"chacha20-poly1305\"; a malformed post-quantum string like \"mlkem768x25519plus\" alone (fewer than 4 dot-separated segments).","commonSituations":"VMess-to-VLESS config conversion leaving the security field in place; following VMess documentation for a VLESS outbound; attempting the experimental mlkem hybrid encryption without the full parameter string from a matching client.","solutions":["Set \"encryption\":\"none\" — correct for all standard VLESS usage","If you intentionally use the mlkem768x25519plus hybrid, copy the full spec string exactly as produced by the peer/generator (mode, keys, padding segments included)","Remove any VMess security values (auto/aes-128-gcm/chacha20-poly1305) from VLESS users"],"exampleFix":"// before\n\"users\": [ { \"id\": \"...\", \"encryption\": \"auto\" } ]\n// after\n\"users\": [ { \"id\": \"...\", \"encryption\": \"none\" } ]","handlingStrategy":"validation","validationCode":"func validateVlessEncryptionValue(v string) error {\n\tif v == \"none\" || v == \"\" { return nil }\n\ts := strings.Split(v, \".\")\n\tif len(s) < 4 || s[0] != \"mlkem768x25519plus\" {\n\t\treturn fmt.Errorf(\"unsupported encryption %q (VMess values like auto/aes-128-gcm are invalid in VLESS)\", v)\n\t}\n\tswitch s[1] {\n\tcase \"native\", \"xorpub\", \"random\":\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"unsupported mlkem mode %q\", s[1])\n}","typeGuard":"func vlessEncryptionSupported(v string) bool {\n\tif v == \"none\" { return true }\n\ts := strings.Split(v, \".\")\n\tif len(s) < 4 || s[0] != \"mlkem768x25519plus\" { return false }\n\tswitch s[1] {\n\tcase \"native\", \"xorpub\", \"random\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":null,"preventionTips":["Default every VLESS user to \"encryption\":\"none\"","Never carry VMess security values (auto, aes-128-gcm, chacha20-poly1305) into VLESS","If using the mlkem768x25519plus hybrid, treat the full spec string as opaque and copy it verbatim from the peer"],"tags":["vless","encryption","post-quantum","config","validation","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}