7.2High
CVE-2026-88895CyberPanel before 3.0.5 Authentication Bypass via API
Description
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Weakness (CWE):
CWE-287
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| cyberpanel | cyberpanel | < 3.0.5 | |
| usmannasir | cyberpanel | < 3.0.5, fixed 3.0.5 |
References and patches
- GitHub Security Advisory (GHSA-h2f7-38ww-5pwc) vendor-advisory
- VulnCheck Advisory: CyberPanel before 3.0.5 Authentication Bypass via API third-party-advisory