CVE-2026-56022
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
Risk Assessment
Risk of bypassing multi-factor authentication and unauthorized access to the Webmin admin panel, potentially leading to full system compromise.
Recommendation
Upgrade Webmin to version 2.640 or later. Additionally, restrict access to Webmin and monitor for unusual User-Agent headers.
Other vulnerabilities in Webmin
See all- CVE-2017-15645High
CSRF exists in Webmin 1.850, allowing an attacker to execute arbitrary commands by sending a GET request to at/create_job.cgi with dir=/&cmd= in the URI.
- CVE-2017-15644High
There is an SSRF vulnerability in Webmin 1.850 that allows an attacker to exploit the PATH_INFO parameter to make a GET request to tunnel/link.cgi with an external IP address.
- CVE-2019-15107CriticalActively exploited
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
- CVE-2026-42210Medium
Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts requiring a second authentication factor (typically TOTP), an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication. As a workaround, apply the patch from commit da18a16c84ae5c0b78cad79609cb0efb174000ec manually.
- CVE-2026-56021Medium
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- CVE-2026-56020High
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. An attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
- CVE-2026-22678Medium
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module. Low-privileged authenticated attackers can execute arbitrary JavaScript in the browser context of administrators by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.
- CVE-2023-40983Medium
A reflected cross-site scripting (XSS) vulnerability exists in the File Manager function of Webmin v2.100. It allows attackers to execute malicious scripts by injecting a crafted payload into the 'Find in Results' file.
- CVE-2023-40982Medium
Webmin version 2.100 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious HTML or JavaScript code via the cloned module name parameter.
- CVE-2023-40986Medium
A stored XSS vulnerability was found in Webmin v2.100 in the Usermin Configuration function. Attackers can inject malicious JavaScript or HTML into the Custom field, leading to script execution in the victim's browser.
Original NVD description (English source)
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.