7.2Hoch
CVE-2026-88895CyberPanel before 3.0.5 Authentication Bypass via API
Beschreibung
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Schwachstellentyp (CWE):
CWE-287
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| cyberpanel | cyberpanel | < 3.0.5 | |
| usmannasir | cyberpanel | < 3.0.5, fixed 3.0.5 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-h2f7-38ww-5pwc) vendor-advisory
- VulnCheck Advisory: CyberPanel before 3.0.5 Authentication Bypass via API third-party-advisory