XUI One vs Xtream UI in 2026: licensing, security and cost

XUI One vs Xtream UI is the comparison every operator who inherits a legacy panel ends up making. Both panels share a code lineage, a database layout and the client API that nearly every IPTV app implements, so switching between them is less dramatic than switching to a product from a different family. The differences are about who maintains the software, which operating systems it runs on, what it costs, and how much security work lands on you. This article replaces a 2023 post that was already out of date when it was written, and it tries to give you the 2026 picture without recommending anything we cannot verify.

The short history

Xtream Codes, the original commercial panel, was shut down in September 2019. Xtream UI appeared shortly after as a free panel built on the same code base; most former Xtream Codes operators moved to it. Official Xtream UI development ended with the R21 stable and R22F early-access releases in the 2020–2021 period, and the project site went offline.

XUI One was launched by people from the same project as the paid, closed-source successor. It kept the architecture (main server plus load balancers), the vocabulary (streams, bouquets, lines, resellers) and the client API, and added a licence server, a rewritten admin interface and support for newer Ubuntu releases. The old article claimed in a 2023 update that XUI One had “stopped their service in early 2022”. That claim does not match the release activity since, but we will not make the opposite claim for you either: before you pay for a licence, check the vendor’s site and current release notes yourself, and be aware that a closed-source panel with a licence server stops working for everyone if the vendor disappears.

For installation specifics see Installing Xtream UI in 2026 and the XUI One installation guide.

Comparison table

	XUI One	Xtream UI
Licensing	Commercial, closed source. Licence is bound to the server and checked against a licence server.	Free. No licence check. No official distribution any more; every copy is a mirror.
Maintenance	Maintained by the vendor; releases continue. Frequency varies; check the current release notes.	None since R22F (2021 era). Only community modifications, unverifiable.
OS support	Current Ubuntu LTS releases. Which exact versions a given build supports is in its release notes.	Ubuntu 18.04 (end of standard support since May 2023) for the original installer. Newer Ubuntu only through third-party installers.
Architecture	Main server + load balancers, same model.	Main server + load balancers.
Client API	Xtream Codes compatible, plus vendor extensions.	Xtream Codes compatible; the reference implementation.
Admin features	Reworked admin UI, more reseller controls, more bulk tools, better stream and server monitoring, import from Xtream UI databases. Specific features vary by version.	Full feature set as of 2021: streams, VOD, series, bouquets, lines, MAG/Enigma, resellers, EPG, mass tools. Frozen.
Security track record	Closed source; fewer public vulnerability reports, but you depend on the vendor to disclose and fix. Cracked copies circulate with modifications.	Inherited Xtream Codes weaknesses; several public reports; many fixes only in unofficial builds. Modified builds with backdoors have been found.
Dependencies	Vendor-bundled stack built for the supported Ubuntu release.	Bundled nginx and PHP 7.x, host MariaDB from Ubuntu 18.04. All end-of-life.
Cost	Recurring licence fee per installation (the 2023 article quoted a monthly price; it is outdated and we do not repeat it). Plus servers.	No licence fee. Plus servers, plus the hours you spend hardening and patching around an unmaintained stack.
Support	Vendor support channels tied to the licence.	Community forums, Telegram groups, your own staff.
Exit path	Database export; migration tools depend on the target.	Database export; XUI One and some newer panels import it directly.

Licensing and what it means operationally

Xtream UI’s freedom is real but shallow. There is no licence to pay and no server to call home, which also means there is nobody to ask when something breaks and no way to verify that the archive you downloaded is the archive the developers released. You own the risk entirely.

XUI One’s licence is a dependency. The panel verifies the licence against the vendor’s server, so a vendor outage, a payment dispute or a change in the vendor’s terms can affect your panel. In exchange you get a verifiable build, updates and someone to report bugs to. For a business this is usually the right trade, but you should know what you are trading.

Maintenance and OS support

This is the deciding factor in 2026 and the old article barely touched it.

Xtream UI is frozen. Its installer targets Ubuntu 18.04, which left standard support in 2023. Its bundled PHP belongs to the 7.x line, unsupported since the end of 2022. You cannot update these components without breaking the panel, and the community installers that promise Ubuntu 20.04 or 22.04 compatibility each solve the problem in their own way, with their own trust questions. See the installation guide for the detail.

XUI One is built for current Ubuntu LTS releases, which means your OS layer receives security updates for years, and the vendor is responsible for keeping the panel’s own stack working. Whether a specific XUI One version supports the Ubuntu release you want to use is a question for the current release notes, not for a blog post.

Features

On paper the feature lists overlap heavily, because XUI One started from the Xtream UI feature set. The differences that matter in daily operation:

• Reseller management. XUI One expanded reseller permissions, packages and reporting. Xtream UI’s reseller layer works but has not changed since 2021.
• Monitoring and bulk tools. XUI One shows more about stream health and server load and offers more mass-edit operations. On Xtream UI you compensate with external monitoring and direct database edits.
• Import. XUI One imports Xtream UI databases, which makes the migration from one to the other the easiest panel migration in the industry. The reverse is not supported.
• Media metadata, EPG, output formats. Comparable. Both match EPG by channel ID and both leave much of the matching to you.
• Billing. Neither panel includes a customer-facing shop or payment processing. Both expect an external billing system talking to the reseller API.

If you need a feature-by-feature list for a specific version, use the vendor’s changelog; feature lists in blog posts, including this one, go stale. The XUI One panel commands guide covers the day-to-day operations once you are running it.

Security track record

Xtream UI’s record is public and poor: default admin paths and credentials, a reseller API with historic injection reports, encoded configuration that is trivial to decode, and a culture of installing modified builds from anonymous sources. Many of the fixes operators rely on exist only in those unofficial builds. If you run Xtream UI, assume the panel is hostile territory and firewall accordingly.

XUI One has fewer public incidents, partly because it is closed source and younger, partly because the vendor fixes issues and ships updates. “Fewer public reports” is not the same as “secure”; it means you depend on the vendor’s disclosure. The cracked XUI One builds that circulate have the same backdoor problem as modified Xtream UI builds and add licence-bypass code that you cannot inspect. They are not a middle way; they are the worst of both columns.

Cost

Xtream UI costs no licence fee. It costs servers, and it costs the time of whoever hardens it, watches for vulnerabilities in components that will never be patched, and handles the eventual forced migration. For a one-person operation with a few hundred lines that time is often invisible and the panel looks free. For a business with staff and paying customers it is a real line item with an unknown ceiling.

XUI One costs a recurring licence per installation plus servers. The fee buys maintenance and a vendor relationship. Whether it is worth it depends on how many hours of your own time it replaces and on how much a security incident would cost you. We do not quote the price because the figure in the 2023 article is unverifiable today; the vendor’s site is the only reliable source.

Who should pick which

Pick Xtream UI if

• You are running a lab, learning the architecture, or studying the API that players implement.
• You inherited an Xtream UI installation and need to keep it alive for a defined migration period.
• You have no budget at all and accept that you are operating unmaintained software on an unsupported OS, with the hardening work described in the installation guide.

Pick XUI One if

• You run or plan a business with paying customers and want a maintained panel on a supported OS.
• You already run Xtream UI and want the least painful migration path; the importer exists for exactly this case.
• You can live with a licence dependency on a single closed-source vendor and have checked that vendor’s current state yourself.

Pick neither if

• You do not want to operate servers, nginx, FFmpeg and a database at all.
• Your team’s time is better spent on content agreements, support and marketing than on load balancers.

In that case a hosted panel is the third option, covered next.

The third option: a hosted panel

Both panels in this comparison assume you rent servers, install the software and keep it running. A hosted panel moves that layer to a provider: you get the panel, the streaming infrastructure and the updates as a service, and you give up control over the servers and accept a monthly dependency on the provider instead of a licence server. Whether that is a good trade depends on your size, your technical staff and your tolerance for lock-in. IPTVBlog is sponsored by IPTVOS, a hosted panel, and we have written a separate IPTVOS review that covers what it does, what it does not do yet and where it falls short compared with self-hosted panels. Read it with the sponsorship in mind, and compare it against the two self-hosted options above on the same criteria: maintenance, security, cost and exit path.

Verdict

Xtream UI is a free, familiar, frozen panel on an end-of-life platform. XUI One is its paid, maintained continuation with a licence dependency. If you are learning or keeping a legacy installation alive, Xtream UI with serious hardening is defensible. If you are running a business, pay for the maintained panel or move to a hosted one. The one option that has no case is a cracked build of either.