7.2Alta
CVE-2026-88895CyberPanel before 3.0.5 Authentication Bypass via API
Descripción
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Debilidad (CWE):
CWE-287
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| cyberpanel | cyberpanel | < 3.0.5 | |
| usmannasir | cyberpanel | < 3.0.5, fixed 3.0.5 |
Referencias y parches
- GitHub Security Advisory (GHSA-h2f7-38ww-5pwc) vendor-advisory
- VulnCheck Advisory: CyberPanel before 3.0.5 Authentication Bypass via API third-party-advisory