CVE-2026-87820

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. The lack of logging makes it difficult to detect unauthorized changes.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. This may lead to incorrect function behavior.

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. An attacker who obtains an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.

CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.