CVE-2026-88895
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. An attacker who obtains an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Risk Assessment
An attacker with the administrator password could completely bypass 2FA and gain administrative control over CyberPanel, leading to full server takeover.
Recommendation
Update CyberPanel to version 3.0.5 or later to enforce 2FA on API endpoints.
Other vulnerabilities in CyberPanel
See all- CVE-2026-67614Critical
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.
- CVE-2026-41473Critical
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to /api/ai-scanner/status-webhook and /api/ai-scanner/callback. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
- CVE-2024-51567CriticalActively exploited
The upgrademysqlstatus function in databases/views.py in CyberPanel before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- CVE-2024-51378CriticalActively exploited
getresetstatus in dns/views.py and ftp/views.py in CyberPanel before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- CVE-2026-29812Medium
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. The lack of logging makes it difficult to detect unauthorized changes.
- CVE-2026-29811High
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.
- CVE-2026-29810Medium
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. This may lead to incorrect function behavior.
- CVE-2026-87820Medium
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
- CVE-2026-67613Medium
CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.
- CVE-2026-71966High
CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.
Original NVD description (English source)
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.