CVE-2026-42210
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts requiring a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
Risk Assessment
The risk involves bypassing two-factor authentication, potentially leading to unauthorized access to the Webmin administration panel.
Recommendation
Immediately upgrade to version 2.640 or later; if not possible, manually apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec.
Other vulnerabilities in Webmin
See all- CVE-2017-15645High
CSRF exists in Webmin 1.850, allowing an attacker to execute arbitrary commands by sending a GET request to at/create_job.cgi with dir=/&cmd= in the URI.
- CVE-2017-15644High
There is an SSRF vulnerability in Webmin 1.850 that allows an attacker to exploit the PATH_INFO parameter to make a GET request to tunnel/link.cgi with an external IP address.
- CVE-2026-49243Critical
Webmin before version 2.650 contains an XSS vulnerability that can be exploited when a user clicks a malicious link to their server. An attacker can execute arbitrary commands in the user's context.
- CVE-2019-15107CriticalActively exploited
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
- CVE-2026-56022Medium
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
- CVE-2026-56021Medium
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- CVE-2026-56020High
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. An attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
- CVE-2026-22678Medium
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
- CVE-2023-40983Medium
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.
- CVE-2023-40982Medium
Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.
Original NVD description (English source)
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. Webmin is a web-based system administration tool for Unix-like servers. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS